Description
Symptoms
The NVD on-demand update page does not allow for any options to be selected. Also, the 'Status' is stuck on "Importing CVSS3.
Navigate to Vulnerability Response > On-Demand Update module, the National Vulnerability Database feeds listed are showing the status of "Importing CVSS3"
On reviewing "Vulnerability Data Source Import Queue Entries" reports error "Encountered error trying to add attachment to queue entry. Error was Error: no attachment found" for "NVD CVSS Import" data source
Release
Madrid Patch 3
Cause
The flow for NVD import is import using xml first and then import CVSS3 integration for populating CVSS3 information. CVSS3 integration will get a json zip file and the integration will parse the zip file for cvss3 information, state will change from cvss3 importing to ready once CVSS3 integration is completed.
Hence this will happen if glide.attachment.extensions sys-property does not include zip extension, so when the system tries to save respond body and attach the json attachment, system rejects and CVSS3 integration reports error and state does not change back to ready.
Resolution
Add zip to the list. (see attachment)
navigate to System properties--> Security, add zip to "list of file extensions..."
in Madrid path 4, there is a new version of NVD import which will totally use JSON file to parse all the information and using JAVA to do parse, which will be faster. so you could alternately upgrade to Madrid Patch 4 as well.
navigate to System properties--> Security, add zip to "list of file extensions..."
in Madrid path 4, there is a new version of NVD import which will totally use JSON file to parse all the information and using JAVA to do parse, which will be faster. so you could alternately upgrade to Madrid Patch 4 as well.