Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

breaking-change(db): separate Nvd and Jvn #192

Merged
merged 47 commits into from
Aug 13, 2021
Merged

breaking-change(db): separate Nvd and Jvn #192

merged 47 commits into from
Aug 13, 2021

Conversation

MaineK00n
Copy link
Collaborator

@MaineK00n MaineK00n commented Jul 12, 2021 •
edited
Loading

What did you implement:

Since Insert and Search are difficult to use, NVD and JVN are separated and managed separately.
It seems that Nvd used to have XML and JSON, but XML was removed by #147.
Therefore, NvdJSON has been changed to Nvd.

And, when obtaining CVE information from CpeURI, the source of CVE information from either NVD or JVN CPE is shown in CveDetail.CveIDSource.

In addition, the following bugs have been fixed by reviewing the DB design.
Fixes #116

This needs to be fixed in Vuls as well.
fix PR: future-architect/vuls#1277

NOTE

In this PR, we are changing the architecture of Redis. Specifically, we have changed Hash to Set. The keys will not be the same, so errors are unlikely to occur, but it is safe to rebuild the DB.
In particular, if you get the following error message, you will need to rebuild the DB.

WRONGTYPE Operation against a key holding the wrong kind of value"

// delete all old hash key
$ redis-cli keys "CVE#*" | xargs redis-cli del

This PR will change the schema of the RDB.
Therefore, if you try to open the old DB with the new go-cve-dictionary binary, you will get the following error message. In this case, please fetch the new DB with the new go-cve-dictionary.

INFO[07-15|09:43:14] Initialize Database
EROR[07-15|09:43:14] Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again
Failed to NewDB. Since SchemaVersion is incompatible, delete Database and fetch again.

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

How Has This Been Tested?

Verify that the output between RDB and Redis using server mode in the new binary is equal.

$ make clean-integration && make build-integration
$ make fetch-rdb && make fetch-redis
$ make diff-server-rdb-redis

Fixed a bug where CVE-IDs were conflicting and data was missing.
In upstream/master: RDB, only the one with "JvnID": "JVNDB-2020-004959" is displayed, and in upstream/master: Redis, only the one with "JvnID": "JVNDB-2020-004960" is displayed. These are conflicting with CVE-2020-11539, so up to now only the first Insert data was saved in RDB, and only the last Set data was saved in Redis.
If PR is looked at, it can be seen that both "JvnID": "JVNDB-2020-004959" and "JvnID": "JVNDB-2020-004960" can be obtained.

// common
$ go-cve-dictionary fetchnvd -last2y
$ go-cve-dictionary fetchjvn -last2y

// upstream/master: RDB
$ curl http://127.0.0.1:1323/cves/CVE-2020-11539 | jq
{
  "CveID": "CVE-2020-11539",
  "NvdJSON": {
    "CveID": "CVE-2020-11539",
    "Descriptions": [
      {
        "Lang": "en",
        "Value": "An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any authentication or signature verification. Thus, any attacker can control a parameter of the device."
      }
    ],
    "Cvss2": {
      "VectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
      "AccessVector": "ADJACENT_NETWORK",
      "AccessComplexity": "LOW",
      "Authentication": "NONE",
      "ConfidentialityImpact": "PARTIAL",
      "IntegrityImpact": "PARTIAL",
      "AvailabilityImpact": "NONE",
      "BaseScore": 4.8,
      "Severity": "MEDIUM",
      "ExploitabilityScore": 6.5,
      "ImpactScore": 4.9,
      "ObtainAllPrivilege": false,
      "ObtainUserPrivilege": false,
      "ObtainOtherPrivilege": false,
      "UserInteractionRequired": false
    },
    "Cvss3": {
      "VectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "AttackVector": "ADJACENT_NETWORK",
      "AttackComplexity": "LOW",
      "PrivilegesRequired": "NONE",
      "UserInteraction": "NONE",
      "Scope": "UNCHANGED",
      "ConfidentialityImpact": "HIGH",
      "IntegrityImpact": "HIGH",
      "AvailabilityImpact": "NONE",
      "BaseScore": 8.1,
      "BaseSeverity": "HIGH",
      "ExploitabilityScore": 2.8,
      "ImpactScore": 5.2
    },
    "Cwes": [
      {
        "CweID": "CWE-347"
      },
      {
        "CweID": "CWE-306"
      },
      {
        "CweID": "CWE-319"
      }
    ],
    "Cpes": [
      {
        "URI": "cpe:/o:titan:sf_rush_smart_band_firmware:1.12",
        "FormattedString": "cpe:2.3:o:titan:sf_rush_smart_band_firmware:1.12:*:*:*:*:*:*:*",
        "WellFormedName": "wfn:[part=\"o\", vendor=\"titan\", product=\"sf_rush_smart_band_firmware\", version=\"1\\.12\", update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
        "Part": "o",
        "Vendor": "titan",
        "Product": "sf_rush_smart_band_firmware",
        "Version": "1\\.12",
        "Update": "ANY",
        "Edition": "ANY",
        "Language": "ANY",
        "SoftwareEdition": "ANY",
        "TargetSW": "ANY",
        "TargetHW": "ANY",
        "Other": "ANY",
        "VersionStartExcluding": "",
        "VersionStartIncluding": "",
        "VersionEndExcluding": "",
        "VersionEndIncluding": "",
        "EnvCpes": []
      }
    ],
    "Affects": [],
    "References": [
      {
        "Link": "https://medium.com/@sayliambure/hacking-a-5-smartband-824763ab6e8f",
        "Source": "MISC",
        "Tags": "Exploit,Third Party Advisory",
        "Name": "https://medium.com/@sayliambure/hacking-a-5-smartband-824763ab6e8f"
      },
      {
        "Link": "https://github.com/the-girl-who-lived/CVE-2020-11539/",
        "Source": "MISC",
        "Tags": "Exploit,Third Party Advisory",
        "Name": "https://github.com/the-girl-who-lived/CVE-2020-11539/"
      }
    ],
    "Certs": [],
    "PublishedDate": "2020-04-22T14:15:00Z",
    "LastModifiedDate": "2021-07-21T11:39:00Z"
  },
  "Jvn": {
    "CveID": "CVE-2020-11539",
    "Title": "D-Link DIR-615 T1 デバイスにおける過度な認証試行の不適切な制限に関する脆弱性",
    "Summary": "D-Link DIR-615 T1 デバイスには、過度な認証試行の不適切な制限に関する脆弱性が存在します。\n",
    "JvnLink": "https://jvndb.jvn.jp/ja/contents/2020/JVNDB-2020-004959.html",
    "JvnID": "JVNDB-2020-004959",
    "Cvss2": {
      "VectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
      "AccessVector": "NETWORK",
      "AccessComplexity": "LOW",
      "Authentication": "SINGLE",
      "ConfidentialityImpact": "PARTIAL",
      "IntegrityImpact": "NONE",
      "AvailabilityImpact": "NONE",
      "BaseScore": 4,
      "Severity": "Medium"
    },
    "Cvss3": {
      "VectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "AttackVector": "NETWORK",
      "AttackComplexity": "LOW",
      "PrivilegesRequired": "LOW",
      "UserInteraction": "NONE",
      "Scope": "UNCHANGED",
      "ConfidentialityImpact": "HIGH",
      "IntegrityImpact": "HIGH",
      "AvailabilityImpact": "HIGH",
      "BaseScore": 8.8,
      "BaseSeverity": "High",
      "ExploitabilityScore": 0,
      "ImpactScore": 0
    },
    "Cpes": [
      {
        "URI": "cpe:/o:d-link:dir-615_firmware",
        "FormattedString": "cpe:2.3:o:d-link:dir-615_firmware:*:*:*:*:*:*:*:*",
        "WellFormedName": "wfn:[part=\"o\", vendor=\"d\\-link\", product=\"dir\\-615_firmware\", version=ANY, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
        "Part": "o",
        "Vendor": "d\\-link",
        "Product": "dir\\-615_firmware",
        "Version": "ANY",
        "Update": "ANY",
        "Edition": "ANY",
        "Language": "ANY",
        "SoftwareEdition": "ANY",
        "TargetSW": "ANY",
        "TargetHW": "ANY",
        "Other": "ANY",
        "VersionStartExcluding": "",
        "VersionStartIncluding": "",
        "VersionEndExcluding": "",
        "VersionEndIncluding": "",
        "EnvCpes": []
      }
    ],
    "References": [
      {
        "Link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17525",
        "Source": "CVE",
        "Tags": "",
        "Name": ""
      },
      {
        "Link": "https://nvd.nist.gov/vuln/detail/CVE-2019-17525",
        "Source": "NVD",
        "Tags": "",
        "Name": ""
      },
      {
        "Link": "https://github.com/huzaifahussain98/CVE-2019-17525/",
        "Source": "関連文書",
        "Tags": "",
        "Name": ""
      },
      {
        "Link": "https://cwe.mitre.org/data/definitions/307.html",
        "Source": "",
        "Tags": "",
        "Name": "過度な認証試行の不適切な制限(CWE-307)"
      }
    ],
    "Certs": [],
    "PublishedDate": "2020-06-03T16:30:00+09:00",
    "LastModifiedDate": "2020-06-03T16:30:00+09:00"
  }
}

// upstream/master: Redis
$ curl http://127.0.0.1:1323/cves/CVE-2020-11539 | jq
{
  "CveID": "CVE-2020-11539",
  "NvdJSON": {
    "CveID": "CVE-2020-11539",
    "Descriptions": [
      {
        "Lang": "en",
        "Value": "An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any authentication or signature verification. Thus, any attacker can control a parameter of the device."
      }
    ],
    "Cvss2": {
      "VectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
      "AccessVector": "ADJACENT_NETWORK",
      "AccessComplexity": "LOW",
      "Authentication": "NONE",
      "ConfidentialityImpact": "PARTIAL",
      "IntegrityImpact": "PARTIAL",
      "AvailabilityImpact": "NONE",
      "BaseScore": 4.8,
      "Severity": "MEDIUM",
      "ExploitabilityScore": 6.5,
      "ImpactScore": 4.9,
      "ObtainAllPrivilege": false,
      "ObtainUserPrivilege": false,
      "ObtainOtherPrivilege": false,
      "UserInteractionRequired": false
    },
    "Cvss3": {
      "VectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "AttackVector": "ADJACENT_NETWORK",
      "AttackComplexity": "LOW",
      "PrivilegesRequired": "NONE",
      "UserInteraction": "NONE",
      "Scope": "UNCHANGED",
      "ConfidentialityImpact": "HIGH",
      "IntegrityImpact": "HIGH",
      "AvailabilityImpact": "NONE",
      "BaseScore": 8.1,
      "BaseSeverity": "HIGH",
      "ExploitabilityScore": 2.8,
      "ImpactScore": 5.2
    },
    "Cwes": [
      {
        "CweID": "CWE-347"
      },
      {
        "CweID": "CWE-306"
      },
      {
        "CweID": "CWE-319"
      }
    ],
    "Cpes": [
      {
        "URI": "cpe:/o:titan:sf_rush_smart_band_firmware:1.12",
        "FormattedString": "cpe:2.3:o:titan:sf_rush_smart_band_firmware:1.12:*:*:*:*:*:*:*",
        "WellFormedName": "wfn:[part=\"o\", vendor=\"titan\", product=\"sf_rush_smart_band_firmware\", version=\"1\\.12\", update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
        "Part": "o",
        "Vendor": "titan",
        "Product": "sf_rush_smart_band_firmware",
        "Version": "1\\.12",
        "Update": "ANY",
        "Edition": "ANY",
        "Language": "ANY",
        "SoftwareEdition": "ANY",
        "TargetSW": "ANY",
        "TargetHW": "ANY",
        "Other": "ANY",
        "VersionStartExcluding": "",
        "VersionStartIncluding": "",
        "VersionEndExcluding": "",
        "VersionEndIncluding": "",
        "EnvCpes": []
      }
    ],
    "Affects": [],
    "References": [
      {
        "Link": "https://medium.com/@sayliambure/hacking-a-5-smartband-824763ab6e8f",
        "Source": "MISC",
        "Tags": "Exploit,Third Party Advisory",
        "Name": "https://medium.com/@sayliambure/hacking-a-5-smartband-824763ab6e8f"
      },
      {
        "Link": "https://github.com/the-girl-who-lived/CVE-2020-11539/",
        "Source": "MISC",
        "Tags": "Exploit,Third Party Advisory",
        "Name": "https://github.com/the-girl-who-lived/CVE-2020-11539/"
      }
    ],
    "Certs": [],
    "PublishedDate": "2020-04-22T14:15:00Z",
    "LastModifiedDate": "2021-07-21T11:39:00Z"
  },
  "Jvn": {
    "CveID": "CVE-2020-11539",
    "Title": "Tata Sonata Smart SF Rush デバイスにおけるデータの信頼性についての不十分な検証に関する脆弱性",
    "Summary": "Tata Sonata Smart SF Rush デバイスには、データの信頼性についての不十分な検証に関する脆弱性が存在します。\n",
    "JvnLink": "https://jvndb.jvn.jp/ja/contents/2020/JVNDB-2020-004960.html",
    "JvnID": "JVNDB-2020-004960",
    "Cvss2": {
      "VectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
      "AccessVector": "ADJACENT_NETWORK",
      "AccessComplexity": "LOW",
      "Authentication": "NONE",
      "ConfidentialityImpact": "PARTIAL",
      "IntegrityImpact": "PARTIAL",
      "AvailabilityImpact": "NONE",
      "BaseScore": 4.8,
      "Severity": "Medium"
    },
    "Cvss3": {
      "VectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "AttackVector": "ADJACENT_NETWORK",
      "AttackComplexity": "LOW",
      "PrivilegesRequired": "NONE",
      "UserInteraction": "NONE",
      "Scope": "UNCHANGED",
      "ConfidentialityImpact": "HIGH",
      "IntegrityImpact": "HIGH",
      "AvailabilityImpact": "NONE",
      "BaseScore": 8.1,
      "BaseSeverity": "High",
      "ExploitabilityScore": 0,
      "ImpactScore": 0
    },
    "Cpes": [
      {
        "URI": "cpe:/o:titan:sf_rush_smart_band_firmware",
        "FormattedString": "cpe:2.3:o:titan:sf_rush_smart_band_firmware:*:*:*:*:*:*:*:*",
        "WellFormedName": "wfn:[part=\"o\", vendor=\"titan\", product=\"sf_rush_smart_band_firmware\", version=ANY, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
        "Part": "o",
        "Vendor": "titan",
        "Product": "sf_rush_smart_band_firmware",
        "Version": "ANY",
        "Update": "ANY",
        "Edition": "ANY",
        "Language": "ANY",
        "SoftwareEdition": "ANY",
        "TargetSW": "ANY",
        "TargetHW": "ANY",
        "Other": "ANY",
        "VersionStartExcluding": "",
        "VersionStartIncluding": "",
        "VersionEndExcluding": "",
        "VersionEndIncluding": "",
        "EnvCpes": []
      }
    ],
    "References": [
      {
        "Link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11539",
        "Source": "CVE",
        "Tags": "",
        "Name": ""
      },
      {
        "Link": "https://nvd.nist.gov/vuln/detail/CVE-2020-11539",
        "Source": "NVD",
        "Tags": "",
        "Name": ""
      },
      {
        "Link": "https://github.com/the-girl-who-lived/CVE-2020-11539/",
        "Source": "関連文書",
        "Tags": "",
        "Name": ""
      },
      {
        "Link": "https://cwe.mitre.org/data/definitions/345.html",
        "Source": "",
        "Tags": "",
        "Name": "データの信頼性についての不十分な検証(CWE-345)"
      }
    ],
    "Certs": [],
    "PublishedDate": "2020-06-03T16:30:00+09:00",
    "LastModifiedDate": "2020-06-03T16:30:00+09:00"
  }
}

// PR: RDB
$ curl http://127.0.0.1:1323/cves/CVE-2020-11539 | jq
{
  "CveID": "CVE-2020-11539",
  "CveIDSource": "",
  "Nvd": [
    {
      "CveID": "CVE-2020-11539",
      "Descriptions": [
        {
          "Lang": "en",
          "Value": "An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any authentication or signature verification. Thus, any attacker can control a parameter of the device."
        }
      ],
      "Cvss2": {
        "VectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
        "AccessVector": "ADJACENT_NETWORK",
        "AccessComplexity": "LOW",
        "Authentication": "NONE",
        "ConfidentialityImpact": "PARTIAL",
        "IntegrityImpact": "PARTIAL",
        "AvailabilityImpact": "NONE",
        "BaseScore": 4.8,
        "Severity": "MEDIUM",
        "ExploitabilityScore": 6.5,
        "ImpactScore": 4.9,
        "ObtainAllPrivilege": false,
        "ObtainUserPrivilege": false,
        "ObtainOtherPrivilege": false,
        "UserInteractionRequired": false
      },
      "Cvss3": {
        "VectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
        "AttackVector": "ADJACENT_NETWORK",
        "AttackComplexity": "LOW",
        "PrivilegesRequired": "NONE",
        "UserInteraction": "NONE",
        "Scope": "UNCHANGED",
        "ConfidentialityImpact": "HIGH",
        "IntegrityImpact": "HIGH",
        "AvailabilityImpact": "NONE",
        "BaseScore": 8.1,
        "BaseSeverity": "HIGH",
        "ExploitabilityScore": 2.8,
        "ImpactScore": 5.2
      },
      "Cwes": [
        {
          "CweID": "CWE-347"
        },
        {
          "CweID": "CWE-306"
        },
        {
          "CweID": "CWE-319"
        }
      ],
      "Cpes": [
        {
          "URI": "cpe:/o:titan:sf_rush_smart_band_firmware:1.12",
          "FormattedString": "cpe:2.3:o:titan:sf_rush_smart_band_firmware:1.12:*:*:*:*:*:*:*",
          "WellFormedName": "wfn:[part=\"o\", vendor=\"titan\", product=\"sf_rush_smart_band_firmware\", version=\"1\\.12\", update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
          "Part": "o",
          "Vendor": "titan",
          "Product": "sf_rush_smart_band_firmware",
          "Version": "1\\.12",
          "Update": "ANY",
          "Edition": "ANY",
          "Language": "ANY",
          "SoftwareEdition": "ANY",
          "TargetSW": "ANY",
          "TargetHW": "ANY",
          "Other": "ANY",
          "VersionStartExcluding": "",
          "VersionStartIncluding": "",
          "VersionEndExcluding": "",
          "VersionEndIncluding": "",
          "EnvCpes": []
        }
      ],
      "Affects": [],
      "References": [
        {
          "Link": "https://medium.com/@sayliambure/hacking-a-5-smartband-824763ab6e8f",
          "Source": "MISC",
          "Tags": "Exploit,Third Party Advisory",
          "Name": "https://medium.com/@sayliambure/hacking-a-5-smartband-824763ab6e8f"
        },
        {
          "Link": "https://github.com/the-girl-who-lived/CVE-2020-11539/",
          "Source": "MISC",
          "Tags": "Exploit,Third Party Advisory",
          "Name": "https://github.com/the-girl-who-lived/CVE-2020-11539/"
        }
      ],
      "Certs": [],
      "PublishedDate": "2020-04-22T14:15:00Z",
      "LastModifiedDate": "2021-07-21T11:39:00Z"
    }
  ],
  "Jvn": [
    {
      "CveID": "CVE-2020-11539",
      "Title": "D-Link DIR-615 T1 デバイスにおける過度な認証試行の不適切な制限に関する脆弱性",
      "Summary": "D-Link DIR-615 T1 デバイスには、過度な認証試行の不適切な制限に関する脆弱性が存在します。\n",
      "JvnLink": "https://jvndb.jvn.jp/ja/contents/2020/JVNDB-2020-004959.html",
      "JvnID": "JVNDB-2020-004959",
      "Cvss2": {
        "VectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
        "AccessVector": "NETWORK",
        "AccessComplexity": "LOW",
        "Authentication": "SINGLE",
        "ConfidentialityImpact": "PARTIAL",
        "IntegrityImpact": "NONE",
        "AvailabilityImpact": "NONE",
        "BaseScore": 4,
        "Severity": "Medium"
      },
      "Cvss3": {
        "VectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
        "AttackVector": "NETWORK",
        "AttackComplexity": "LOW",
        "PrivilegesRequired": "LOW",
        "UserInteraction": "NONE",
        "Scope": "UNCHANGED",
        "ConfidentialityImpact": "HIGH",
        "IntegrityImpact": "HIGH",
        "AvailabilityImpact": "HIGH",
        "BaseScore": 8.8,
        "BaseSeverity": "High",
        "ExploitabilityScore": 0,
        "ImpactScore": 0
      },
      "Cpes": [
        {
          "URI": "cpe:/o:d-link:dir-615_firmware",
          "FormattedString": "cpe:2.3:o:d-link:dir-615_firmware:*:*:*:*:*:*:*:*",
          "WellFormedName": "wfn:[part=\"o\", vendor=\"d\\-link\", product=\"dir\\-615_firmware\", version=ANY, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
          "Part": "o",
          "Vendor": "d\\-link",
          "Product": "dir\\-615_firmware",
          "Version": "ANY",
          "Update": "ANY",
          "Edition": "ANY",
          "Language": "ANY",
          "SoftwareEdition": "ANY",
          "TargetSW": "ANY",
          "TargetHW": "ANY",
          "Other": "ANY",
          "VersionStartExcluding": "",
          "VersionStartIncluding": "",
          "VersionEndExcluding": "",
          "VersionEndIncluding": ""
        }
      ],
      "References": [
        {
          "Link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17525",
          "Source": "CVE",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://nvd.nist.gov/vuln/detail/CVE-2019-17525",
          "Source": "NVD",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://github.com/huzaifahussain98/CVE-2019-17525/",
          "Source": "関連文書",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://cwe.mitre.org/data/definitions/307.html",
          "Source": "",
          "Tags": "",
          "Name": "過度な認証試行の不適切な制限(CWE-307)"
        }
      ],
      "Certs": [],
      "PublishedDate": "2020-06-03T16:30:00+09:00",
      "LastModifiedDate": "2020-06-03T16:30:00+09:00"
    },
    {
      "CveID": "CVE-2020-11539",
      "Title": "Tata Sonata Smart SF Rush デバイスにおけるデータの信頼性についての不十分な検証に関する脆弱性",
      "Summary": "Tata Sonata Smart SF Rush デバイスには、データの信頼性についての不十分な検証に関する脆弱性が存在します。\n",
      "JvnLink": "https://jvndb.jvn.jp/ja/contents/2020/JVNDB-2020-004960.html",
      "JvnID": "JVNDB-2020-004960",
      "Cvss2": {
        "VectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
        "AccessVector": "ADJACENT_NETWORK",
        "AccessComplexity": "LOW",
        "Authentication": "NONE",
        "ConfidentialityImpact": "PARTIAL",
        "IntegrityImpact": "PARTIAL",
        "AvailabilityImpact": "NONE",
        "BaseScore": 4.8,
        "Severity": "Medium"
      },
      "Cvss3": {
        "VectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
        "AttackVector": "ADJACENT_NETWORK",
        "AttackComplexity": "LOW",
        "PrivilegesRequired": "NONE",
        "UserInteraction": "NONE",
        "Scope": "UNCHANGED",
        "ConfidentialityImpact": "HIGH",
        "IntegrityImpact": "HIGH",
        "AvailabilityImpact": "NONE",
        "BaseScore": 8.1,
        "BaseSeverity": "High",
        "ExploitabilityScore": 0,
        "ImpactScore": 0
      },
      "Cpes": [
        {
          "URI": "cpe:/o:titan:sf_rush_smart_band_firmware",
          "FormattedString": "cpe:2.3:o:titan:sf_rush_smart_band_firmware:*:*:*:*:*:*:*:*",
          "WellFormedName": "wfn:[part=\"o\", vendor=\"titan\", product=\"sf_rush_smart_band_firmware\", version=ANY, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
          "Part": "o",
          "Vendor": "titan",
          "Product": "sf_rush_smart_band_firmware",
          "Version": "ANY",
          "Update": "ANY",
          "Edition": "ANY",
          "Language": "ANY",
          "SoftwareEdition": "ANY",
          "TargetSW": "ANY",
          "TargetHW": "ANY",
          "Other": "ANY",
          "VersionStartExcluding": "",
          "VersionStartIncluding": "",
          "VersionEndExcluding": "",
          "VersionEndIncluding": ""
        }
      ],
      "References": [
        {
          "Link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11539",
          "Source": "CVE",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://nvd.nist.gov/vuln/detail/CVE-2020-11539",
          "Source": "NVD",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://github.com/the-girl-who-lived/CVE-2020-11539/",
          "Source": "関連文書",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://cwe.mitre.org/data/definitions/345.html",
          "Source": "",
          "Tags": "",
          "Name": "データの信頼性についての不十分な検証(CWE-345)"
        }
      ],
      "Certs": [],
      "PublishedDate": "2020-06-03T16:30:00+09:00",
      "LastModifiedDate": "2020-06-03T16:30:00+09:00"
    }
  ]
}

// PR: Redis
$ curl http://127.0.0.1:1323/cves/CVE-2020-11539 | jq
{
  "CveID": "CVE-2020-11539",
  "CveIDSource": "",
  "Nvd": [
    {
      "CveID": "CVE-2020-11539",
      "Descriptions": [
        {
          "Lang": "en",
          "Value": "An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any authentication or signature verification. Thus, any attacker can control a parameter of the device."
        }
      ],
      "Cvss2": {
        "VectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
        "AccessVector": "ADJACENT_NETWORK",
        "AccessComplexity": "LOW",
        "Authentication": "NONE",
        "ConfidentialityImpact": "PARTIAL",
        "IntegrityImpact": "PARTIAL",
        "AvailabilityImpact": "NONE",
        "BaseScore": 4.8,
        "Severity": "MEDIUM",
        "ExploitabilityScore": 6.5,
        "ImpactScore": 4.9,
        "ObtainAllPrivilege": false,
        "ObtainUserPrivilege": false,
        "ObtainOtherPrivilege": false,
        "UserInteractionRequired": false
      },
      "Cvss3": {
        "VectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
        "AttackVector": "ADJACENT_NETWORK",
        "AttackComplexity": "LOW",
        "PrivilegesRequired": "NONE",
        "UserInteraction": "NONE",
        "Scope": "UNCHANGED",
        "ConfidentialityImpact": "HIGH",
        "IntegrityImpact": "HIGH",
        "AvailabilityImpact": "NONE",
        "BaseScore": 8.1,
        "BaseSeverity": "HIGH",
        "ExploitabilityScore": 2.8,
        "ImpactScore": 5.2
      },
      "Cwes": [
        {
          "CweID": "CWE-347"
        },
        {
          "CweID": "CWE-306"
        },
        {
          "CweID": "CWE-319"
        }
      ],
      "Cpes": [
        {
          "URI": "cpe:/o:titan:sf_rush_smart_band_firmware:1.12",
          "FormattedString": "cpe:2.3:o:titan:sf_rush_smart_band_firmware:1.12:*:*:*:*:*:*:*",
          "WellFormedName": "wfn:[part=\"o\", vendor=\"titan\", product=\"sf_rush_smart_band_firmware\", version=\"1\\.12\", update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
          "Part": "o",
          "Vendor": "titan",
          "Product": "sf_rush_smart_band_firmware",
          "Version": "1\\.12",
          "Update": "ANY",
          "Edition": "ANY",
          "Language": "ANY",
          "SoftwareEdition": "ANY",
          "TargetSW": "ANY",
          "TargetHW": "ANY",
          "Other": "ANY",
          "VersionStartExcluding": "",
          "VersionStartIncluding": "",
          "VersionEndExcluding": "",
          "VersionEndIncluding": "",
          "EnvCpes": []
        }
      ],
      "Affects": [],
      "References": [
        {
          "Link": "https://medium.com/@sayliambure/hacking-a-5-smartband-824763ab6e8f",
          "Source": "MISC",
          "Tags": "Exploit,Third Party Advisory",
          "Name": "https://medium.com/@sayliambure/hacking-a-5-smartband-824763ab6e8f"
        },
        {
          "Link": "https://github.com/the-girl-who-lived/CVE-2020-11539/",
          "Source": "MISC",
          "Tags": "Exploit,Third Party Advisory",
          "Name": "https://github.com/the-girl-who-lived/CVE-2020-11539/"
        }
      ],
      "Certs": [],
      "PublishedDate": "2020-04-22T14:15:00Z",
      "LastModifiedDate": "2021-07-21T11:39:00Z"
    }
  ],
  "Jvn": [
    {
      "CveID": "CVE-2020-11539",
      "Title": "Tata Sonata Smart SF Rush デバイスにおけるデータの信頼性についての不十分な検証に関する脆弱性",
      "Summary": "Tata Sonata Smart SF Rush デバイスには、データの信頼性についての不十分な検証に関する脆弱性が存在します。\n",
      "JvnLink": "https://jvndb.jvn.jp/ja/contents/2020/JVNDB-2020-004960.html",
      "JvnID": "JVNDB-2020-004960",
      "Cvss2": {
        "VectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
        "AccessVector": "ADJACENT_NETWORK",
        "AccessComplexity": "LOW",
        "Authentication": "NONE",
        "ConfidentialityImpact": "PARTIAL",
        "IntegrityImpact": "PARTIAL",
        "AvailabilityImpact": "NONE",
        "BaseScore": 4.8,
        "Severity": "Medium"
      },
      "Cvss3": {
        "VectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
        "AttackVector": "ADJACENT_NETWORK",
        "AttackComplexity": "LOW",
        "PrivilegesRequired": "NONE",
        "UserInteraction": "NONE",
        "Scope": "UNCHANGED",
        "ConfidentialityImpact": "HIGH",
        "IntegrityImpact": "HIGH",
        "AvailabilityImpact": "NONE",
        "BaseScore": 8.1,
        "BaseSeverity": "High",
        "ExploitabilityScore": 0,
        "ImpactScore": 0
      },
      "Cpes": [
        {
          "URI": "cpe:/o:titan:sf_rush_smart_band_firmware",
          "FormattedString": "cpe:2.3:o:titan:sf_rush_smart_band_firmware:*:*:*:*:*:*:*:*",
          "WellFormedName": "wfn:[part=\"o\", vendor=\"titan\", product=\"sf_rush_smart_band_firmware\", version=ANY, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
          "Part": "o",
          "Vendor": "titan",
          "Product": "sf_rush_smart_band_firmware",
          "Version": "ANY",
          "Update": "ANY",
          "Edition": "ANY",
          "Language": "ANY",
          "SoftwareEdition": "ANY",
          "TargetSW": "ANY",
          "TargetHW": "ANY",
          "Other": "ANY",
          "VersionStartExcluding": "",
          "VersionStartIncluding": "",
          "VersionEndExcluding": "",
          "VersionEndIncluding": ""
        }
      ],
      "References": [
        {
          "Link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11539",
          "Source": "CVE",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://nvd.nist.gov/vuln/detail/CVE-2020-11539",
          "Source": "NVD",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://github.com/the-girl-who-lived/CVE-2020-11539/",
          "Source": "関連文書",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://cwe.mitre.org/data/definitions/345.html",
          "Source": "",
          "Tags": "",
          "Name": "データの信頼性についての不十分な検証(CWE-345)"
        }
      ],
      "Certs": [],
      "PublishedDate": "2020-06-03T16:30:00+09:00",
      "LastModifiedDate": "2020-06-03T16:30:00+09:00"
    },
    {
      "CveID": "CVE-2020-11539",
      "Title": "D-Link DIR-615 T1 デバイスにおける過度な認証試行の不適切な制限に関する脆弱性",
      "Summary": "D-Link DIR-615 T1 デバイスには、過度な認証試行の不適切な制限に関する脆弱性が存在します。\n",
      "JvnLink": "https://jvndb.jvn.jp/ja/contents/2020/JVNDB-2020-004959.html",
      "JvnID": "JVNDB-2020-004959",
      "Cvss2": {
        "VectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
        "AccessVector": "NETWORK",
        "AccessComplexity": "LOW",
        "Authentication": "SINGLE",
        "ConfidentialityImpact": "PARTIAL",
        "IntegrityImpact": "NONE",
        "AvailabilityImpact": "NONE",
        "BaseScore": 4,
        "Severity": "Medium"
      },
      "Cvss3": {
        "VectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
        "AttackVector": "NETWORK",
        "AttackComplexity": "LOW",
        "PrivilegesRequired": "LOW",
        "UserInteraction": "NONE",
        "Scope": "UNCHANGED",
        "ConfidentialityImpact": "HIGH",
        "IntegrityImpact": "HIGH",
        "AvailabilityImpact": "HIGH",
        "BaseScore": 8.8,
        "BaseSeverity": "High",
        "ExploitabilityScore": 0,
        "ImpactScore": 0
      },
      "Cpes": [
        {
          "URI": "cpe:/o:d-link:dir-615_firmware",
          "FormattedString": "cpe:2.3:o:d-link:dir-615_firmware:*:*:*:*:*:*:*:*",
          "WellFormedName": "wfn:[part=\"o\", vendor=\"d\\-link\", product=\"dir\\-615_firmware\", version=ANY, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
          "Part": "o",
          "Vendor": "d\\-link",
          "Product": "dir\\-615_firmware",
          "Version": "ANY",
          "Update": "ANY",
          "Edition": "ANY",
          "Language": "ANY",
          "SoftwareEdition": "ANY",
          "TargetSW": "ANY",
          "TargetHW": "ANY",
          "Other": "ANY",
          "VersionStartExcluding": "",
          "VersionStartIncluding": "",
          "VersionEndExcluding": "",
          "VersionEndIncluding": ""
        }
      ],
      "References": [
        {
          "Link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17525",
          "Source": "CVE",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://nvd.nist.gov/vuln/detail/CVE-2019-17525",
          "Source": "NVD",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://github.com/huzaifahussain98/CVE-2019-17525/",
          "Source": "関連文書",
          "Tags": "",
          "Name": ""
        },
        {
          "Link": "https://cwe.mitre.org/data/definitions/307.html",
          "Source": "",
          "Tags": "",
          "Name": "過度な認証試行の不適切な制限(CWE-307)"
        }
      ],
      "Certs": [],
      "PublishedDate": "2020-06-03T16:30:00+09:00",
      "LastModifiedDate": "2020-06-03T16:30:00+09:00"
    }
  ]
}

In addition, when retrieving CVE information from CpeURI, we used to indicate which CPE the data was obtained from by setting either NVD or JVN to nil.
This PR enables to know which data is obtained from which source by filling Nvd and Jvn in CveDetail.CveIDSource.
Thus, it is no longer necessary to nil the JVN data when it is found in either NVD or JVN.

$ curl -H "Accept: application/json" -H "Content-type: application/json" -X POST -d '{"name": "cpe:/a:abb:800xa_information_manager:5.1"}' http://127.0.0.1:1325/cpes | jq "."
[
  {
    "CveID": "CVE-2020-8477",
    "CveIDSource": "NVD",
    "Nvd": [
      {
        "CveID": "CVE-2020-8477",
        "Descriptions": [
          {
            "Lang": "en",
            "Value": "The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code."
          }
        ],
        "Cvss2": {
          "VectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "AccessVector": "NETWORK",
          "AccessComplexity": "MEDIUM",
          "Authentication": "NONE",
          "ConfidentialityImpact": "PARTIAL",
          "IntegrityImpact": "PARTIAL",
          "AvailabilityImpact": "PARTIAL",
          "BaseScore": 6.8,
          "Severity": "MEDIUM",
          "ExploitabilityScore": 8.6,
          "ImpactScore": 6.4,
          "ObtainAllPrivilege": false,
          "ObtainUserPrivilege": false,
          "ObtainOtherPrivilege": false,
          "UserInteractionRequired": true
        },
        "Cvss3": {
          "VectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "AttackVector": "NETWORK",
          "AttackComplexity": "LOW",
          "PrivilegesRequired": "NONE",
          "UserInteraction": "REQUIRED",
          "Scope": "UNCHANGED",
          "ConfidentialityImpact": "HIGH",
          "IntegrityImpact": "HIGH",
          "AvailabilityImpact": "HIGH",
          "BaseScore": 8.8,
          "BaseSeverity": "HIGH",
          "ExploitabilityScore": 2.8,
          "ImpactScore": 5.9
        },
        "Cwes": [
          {
            "CweID": "CWE-79"
          }
        ],
        "Cpes": [
          {
            "URI": "cpe:/a:abb:800xa_information_manager:5.1",
            "FormattedString": "cpe:2.3:a:abb:800xa_information_manager:5.1:*:*:*:*:*:*:*",
            "WellFormedName": "wfn:[part=\"a\", vendor=\"abb\", product=\"800xa_information_manager\", version=\"5\\.1\", update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
            "Part": "a",
            "Vendor": "abb",
            "Product": "800xa_information_manager",
            "Version": "5\\.1",
            "Update": "ANY",
            "Edition": "ANY",
            "Language": "ANY",
            "SoftwareEdition": "ANY",
            "TargetSW": "ANY",
            "TargetHW": "ANY",
            "Other": "ANY",
            "VersionStartExcluding": "",
            "VersionStartIncluding": "",
            "VersionEndExcluding": "",
            "VersionEndIncluding": "",
            "EnvCpes": []
          },
          {
            "URI": "cpe:/a:abb:800xa_information_manager",
            "FormattedString": "cpe:2.3:a:abb:800xa_information_manager:*:*:*:*:*:*:*:*",
            "WellFormedName": "wfn:[part=\"a\", vendor=\"abb\", product=\"800xa_information_manager\", version=ANY, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
            "Part": "a",
            "Vendor": "abb",
            "Product": "800xa_information_manager",
            "Version": "ANY",
            "Update": "ANY",
            "Edition": "ANY",
            "Language": "ANY",
            "SoftwareEdition": "ANY",
            "TargetSW": "ANY",
            "TargetHW": "ANY",
            "Other": "ANY",
            "VersionStartExcluding": "",
            "VersionStartIncluding": "6.0.0",
            "VersionEndExcluding": "",
            "VersionEndIncluding": "6.0.3.2",
            "EnvCpes": []
          },
          {
            "URI": "cpe:/a:abb:800xa_information_manager:6.1",
            "FormattedString": "cpe:2.3:a:abb:800xa_information_manager:6.1:*:*:*:*:*:*:*",
            "WellFormedName": "wfn:[part=\"a\", vendor=\"abb\", product=\"800xa_information_manager\", version=\"6\\.1\", update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
            "Part": "a",
            "Vendor": "abb",
            "Product": "800xa_information_manager",
            "Version": "6\\.1",
            "Update": "ANY",
            "Edition": "ANY",
            "Language": "ANY",
            "SoftwareEdition": "ANY",
            "TargetSW": "ANY",
            "TargetHW": "ANY",
            "Other": "ANY",
            "VersionStartExcluding": "",
            "VersionStartIncluding": "",
            "VersionEndExcluding": "",
            "VersionEndIncluding": "",
            "EnvCpes": []
          }
        ],
        "Affects": [],
        "References": [
          {
            "Link": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121232&LanguageCode=en&DocumentPartId=&Action=Launch",
            "Source": "MISC",
            "Tags": "Vendor Advisory",
            "Name": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121232&LanguageCode=en&DocumentPartId=&Action=Launch"
          }
        ],
        "Certs": [],
        "PublishedDate": "2020-04-22T15:15:00Z",
        "LastModifiedDate": "2020-04-30T20:27:00Z"
      }
    ],
    "Jvn": [
      {
        "CveID": "CVE-2020-8477",
        "Title": "ABB System 800xA Information Manager におけるクロスサイトスクリプティングの脆弱性",
        "Summary": "ABB System 800xA Information Manager には、クロスサイトスクリプティングの脆弱性が存在します。",
        "JvnLink": "https://jvndb.jvn.jp/ja/contents/2020/JVNDB-2020-004735.html",
        "JvnID": "JVNDB-2020-004735",
        "Cvss2": {
          "VectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "AccessVector": "NETWORK",
          "AccessComplexity": "MEDIUM",
          "Authentication": "NONE",
          "ConfidentialityImpact": "PARTIAL",
          "IntegrityImpact": "PARTIAL",
          "AvailabilityImpact": "PARTIAL",
          "BaseScore": 6.8,
          "Severity": "Medium"
        },
        "Cvss3": {
          "VectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "AttackVector": "NETWORK",
          "AttackComplexity": "LOW",
          "PrivilegesRequired": "NONE",
          "UserInteraction": "REQUIRED",
          "Scope": "UNCHANGED",
          "ConfidentialityImpact": "HIGH",
          "IntegrityImpact": "HIGH",
          "AvailabilityImpact": "HIGH",
          "BaseScore": 8.8,
          "BaseSeverity": "High",
          "ExploitabilityScore": 0,
          "ImpactScore": 0
        },
        "Cpes": [
          {
            "URI": "cpe:/a:abb:800xa_information_manager",
            "FormattedString": "cpe:2.3:a:abb:800xa_information_manager:*:*:*:*:*:*:*:*",
            "WellFormedName": "wfn:[part=\"a\", vendor=\"abb\", product=\"800xa_information_manager\", version=ANY, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
            "Part": "a",
            "Vendor": "abb",
            "Product": "800xa_information_manager",
            "Version": "ANY",
            "Update": "ANY",
            "Edition": "ANY",
            "Language": "ANY",
            "SoftwareEdition": "ANY",
            "TargetSW": "ANY",
            "TargetHW": "ANY",
            "Other": "ANY",
            "VersionStartExcluding": "",
            "VersionStartIncluding": "",
            "VersionEndExcluding": "",
            "VersionEndIncluding": ""
          }
        ],
        "References": [
          {
            "Link": "https://jvn.jp/vu/JVNVU96482880/",
            "Source": "JVN",
            "Tags": "",
            "Name": ""
          },
          {
            "Link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8477",
            "Source": "CVE",
            "Tags": "",
            "Name": ""
          },
          {
            "Link": "https://nvd.nist.gov/vuln/detail/CVE-2020-8477",
            "Source": "NVD",
            "Tags": "",
            "Name": ""
          },
          {
            "Link": "https://www.us-cert.gov/ics/advisories/icsa-20-184-02",
            "Source": "ICS-CERT ADVISORY",
            "Tags": "",
            "Name": ""
          },
          {
            "Link": "https://jvndb.jvn.jp/ja/cwe/CWE-79.html",
            "Source": "",
            "Tags": "",
            "Name": "クロスサイトスクリプティング(CWE-79)"
          }
        ],
        "Certs": [],
        "PublishedDate": "2020-05-26T18:15:00+09:00",
        "LastModifiedDate": "2020-07-06T15:15:00+09:00"
      }
    ]
  },
  {
    "CveID": "CVE-2020-8489",
    "CveIDSource": "JVN",
    "Nvd": [
      {
        "CveID": "CVE-2020-8489",
        "Descriptions": [
          {
            "Lang": "en",
            "Value": "Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management (all published versions) enables an attacker authenticated on the local system to inject data, affecting the runtime values to be stored in the archive, or making Information Management history services unavailable."
          }
        ],
        "Cvss2": {
          "VectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "AccessVector": "LOCAL",
          "AccessComplexity": "LOW",
          "Authentication": "NONE",
          "ConfidentialityImpact": "PARTIAL",
          "IntegrityImpact": "PARTIAL",
          "AvailabilityImpact": "PARTIAL",
          "BaseScore": 4.6,
          "Severity": "MEDIUM",
          "ExploitabilityScore": 3.9,
          "ImpactScore": 6.4,
          "ObtainAllPrivilege": false,
          "ObtainUserPrivilege": false,
          "ObtainOtherPrivilege": false,
          "UserInteractionRequired": false
        },
        "Cvss3": {
          "VectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "AttackVector": "LOCAL",
          "AttackComplexity": "LOW",
          "PrivilegesRequired": "LOW",
          "UserInteraction": "NONE",
          "Scope": "UNCHANGED",
          "ConfidentialityImpact": "HIGH",
          "IntegrityImpact": "HIGH",
          "AvailabilityImpact": "HIGH",
          "BaseScore": 7.8,
          "BaseSeverity": "HIGH",
          "ExploitabilityScore": 1.8,
          "ImpactScore": 5.9
        },
        "Cwes": [
          {
            "CweID": "NVD-CWE-Other"
          }
        ],
        "Cpes": [
          {
            "URI": "cpe:/a:abb:800xa_information_management",
            "FormattedString": "cpe:2.3:a:abb:800xa_information_management:*:*:*:*:*:*:*:*",
            "WellFormedName": "wfn:[part=\"a\", vendor=\"abb\", product=\"800xa_information_management\", version=ANY, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
            "Part": "a",
            "Vendor": "abb",
            "Product": "800xa_information_management",
            "Version": "ANY",
            "Update": "ANY",
            "Edition": "ANY",
            "Language": "ANY",
            "SoftwareEdition": "ANY",
            "TargetSW": "ANY",
            "TargetHW": "ANY",
            "Other": "ANY",
            "VersionStartExcluding": "",
            "VersionStartIncluding": "",
            "VersionEndExcluding": "",
            "VersionEndIncluding": "",
            "EnvCpes": []
          }
        ],
        "Affects": [],
        "References": [
          {
            "Link": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch",
            "Source": "CONFIRM",
            "Tags": "Vendor Advisory",
            "Name": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121236&LanguageCode=en&DocumentPartId=&Action=Launch"
          }
        ],
        "Certs": [],
        "PublishedDate": "2020-04-29T02:15:00Z",
        "LastModifiedDate": "2020-05-08T17:19:00Z"
      }
    ],
    "Jvn": [
      {
        "CveID": "CVE-2020-8489",
        "Title": "ABB System 800xA Information Management における脆弱性",
        "Summary": "ABB System 800xA Information Management には、不特定の脆弱性が存在します。",
        "JvnLink": "https://jvndb.jvn.jp/ja/contents/2020/JVNDB-2020-005104.html",
        "JvnID": "JVNDB-2020-005104",
        "Cvss2": {
          "VectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "AccessVector": "LOCAL",
          "AccessComplexity": "LOW",
          "Authentication": "NONE",
          "ConfidentialityImpact": "PARTIAL",
          "IntegrityImpact": "PARTIAL",
          "AvailabilityImpact": "PARTIAL",
          "BaseScore": 4.6,
          "Severity": "Medium"
        },
        "Cvss3": {
          "VectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "AttackVector": "LOCAL",
          "AttackComplexity": "LOW",
          "PrivilegesRequired": "LOW",
          "UserInteraction": "NONE",
          "Scope": "UNCHANGED",
          "ConfidentialityImpact": "HIGH",
          "IntegrityImpact": "HIGH",
          "AvailabilityImpact": "HIGH",
          "BaseScore": 7.8,
          "BaseSeverity": "High",
          "ExploitabilityScore": 0,
          "ImpactScore": 0
        },
        "Cpes": [
          {
            "URI": "cpe:/a:abb:800xa_information_manager",
            "FormattedString": "cpe:2.3:a:abb:800xa_information_manager:*:*:*:*:*:*:*:*",
            "WellFormedName": "wfn:[part=\"a\", vendor=\"abb\", product=\"800xa_information_manager\", version=ANY, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
            "Part": "a",
            "Vendor": "abb",
            "Product": "800xa_information_manager",
            "Version": "ANY",
            "Update": "ANY",
            "Edition": "ANY",
            "Language": "ANY",
            "SoftwareEdition": "ANY",
            "TargetSW": "ANY",
            "TargetHW": "ANY",
            "Other": "ANY",
            "VersionStartExcluding": "",
            "VersionStartIncluding": "",
            "VersionEndExcluding": "",
            "VersionEndIncluding": ""
          }
        ],
        "References": [
          {
            "Link": "https://jvn.jp/vu/JVNVU94921886/index.html",
            "Source": "JVN",
            "Tags": "",
            "Name": ""
          },
          {
            "Link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8489",
            "Source": "CVE",
            "Tags": "",
            "Name": ""
          },
          {
            "Link": "https://nvd.nist.gov/vuln/detail/CVE-2020-8489",
            "Source": "NVD",
            "Tags": "",
            "Name": ""
          },
          {
            "Link": "https://www.us-cert.gov/ics/advisories/icsa-20-154-03",
            "Source": "ICS-CERT ADVISORY",
            "Tags": "",
            "Name": ""
          },
          {
            "Link": "https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther",
            "Source": "",
            "Tags": "",
            "Name": "その他(CWE-Other)"
          }
        ],
        "Certs": [],
        "PublishedDate": "2020-06-05T17:48:00+09:00",
        "LastModifiedDate": "2020-06-05T17:48:00+09:00"
      }
    ]
  }
]

Checklist:

You don't have to satisfy all of the following.

  • Write tests
  • Write documentation
  • Check that there aren't other open pull requests for the same issue/feature
  • Format your source code by make fmt
  • Pass the test by make test
  • Provide verification config / commands
  • Enable "Allow edits from maintainers" for this PR
  • Update the messages below

Is this ready for review?: YES

Reference

@MaineK00n MaineK00n self-assigned this Jul 12, 2021
@MaineK00n MaineK00n changed the title [WIP] feat(db): separate Nvd and Jvn feat(db): separate Nvd and Jvn Jul 14, 2021
@MaineK00n MaineK00n changed the title feat(db): separate Nvd and Jvn [WIP] feat(db): separate Nvd and Jvn Jul 14, 2021
@MaineK00n MaineK00n mentioned this pull request Jul 23, 2021
Merged
9 tasks
@MaineK00n MaineK00n changed the title [WIP] feat(db): separate Nvd and Jvn feat(db): separate Nvd and Jvn Jul 23, 2021
@kotakanbe kotakanbe self-requested a review August 9, 2021 21:04
kotakanbe
kotakanbe requested changes Aug 10, 2021
View reviewed changes
Copy link
Collaborator

@kotakanbe kotakanbe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I made a few comments :)

db/redis.go Outdated Show resolved Hide resolved
db/rdb.go Show resolved Hide resolved
db/rdb.go Show resolved Hide resolved
kotakanbe
kotakanbe approved these changes Aug 13, 2021
View reviewed changes
Copy link
Collaborator

@kotakanbe kotakanbe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kotakanbe kotakanbe changed the title feat(db): separate Nvd and Jvn breaking-change(db): separate Nvd and Jvn Aug 13, 2021
@kotakanbe kotakanbe merged commit 21ddcc7 into vulsio:master Aug 13, 2021
@MaineK00n MaineK00n deleted the split-db branch August 13, 2021 06:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kotakanbe kotakanbe kotakanbe approved these changes

Assignees

@MaineK00n MaineK00n

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Question: multiple CVE_ID's on JVN db
2 participants
@MaineK00n @kotakanbe