Reported CVE URLs go to 404

[emcfins]

Description

We run reports and provide links to the dev teams we support to any found CVEs when running through Trivy. This includes the aqcuasec links so the teams can learn more.
We have found that many of the links go to 404. For example:

• "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-43800"
• "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-43788",
• "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-43796",
• "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-43788",

All 4 of those appear in a report and they all go to 404 pages.

Link

No response

Suggestions

In what circumstance does this happen? Is there a way you can not remove them from your database website?

Or - if they're being reviewed, redirect the user to a page that explains the current status of that CVE?

[knqyf263]

@simar7 @DmitriyLewen Isn't AVD working now?

[simar7]

Looking at the action history it seems there's no problem with AVD https://github.com/aquasecurity/avd-generator/actions

Does the advisory exist in vuln-list?

[simar7]

It looks like these vulnerabilities were just added yesterday aquasecurity/vuln-list-nvd@ba9c036

And the AVD generator was just kicked off today (happens once a day). They seem to be live now on AVD.

We could run AVD more often than vuln-list updates, that way we wouldn't miss any. @knqyf263 what do you think?

[simar7]

PR for review aquasecurity/avd-generator#97

[knqyf263]

Nice. A few days ago, I also saw someone facing the 404 problem in AVD. More frequent updates will help.

[itaysk]

sorry i forgot to update here but after seeing this i checked the generator Action and saw it was disabled due to inactivity in the repo. I released it and kicked off a manual build which added these recent vulns

[simar7]

Looks like we can use a keep alive action like this one PR here: aquasecurity/avd-generator#98

[knqyf263]

Looks like the action uses this API.

Adding gh api --method PUT /repos/${{ github.repository }}/actions/workflows/${{ github.workflow }}/enable seems enough (I've not debugged this one; WORKFLOW_ID might be wrong).