No documents exist

[AlSharik]

I'm trying to use mirror cve database cveb.in due to nvd api problems, but every time i got this. Can someone help me?

root@N0005:~/test-app# docker run --rm \
  -v $(pwd):/src \
  -v $(pwd)/reports:/report \
  -v $(pwd)/data:/data \
  owasp/dependency-check:11.1.1 \
  --nvdDatafeed https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-{0}.json.gz \
  --project "com.example:test-app:1.0-SNAPSHOT" \
  --scan /src \
  --format HTML \
  --out /report \
  --log /src/dependency-check.log \
  --data data
[INFO] Checking for updates
[INFO] NVD API Cache requires several updates; this could take a couple of minutes.
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2012.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2023.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2011.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2022.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2010.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2021.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2020.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2009.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2008.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2019.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2007.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2018.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2006.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2017.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2005.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2016.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2004.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2015.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2003.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2014.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2002.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2013.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-2024.json.gz
[INFO] Download Started for NVD Cache - https://mirror.cveb.in/nvd/json/cve/1.1/nvdcve-1.1-modified.json.gz
[INFO] Begin database maintenance
[INFO] End database maintenance (2 ms)
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (79 ms)
[INFO] Check for updates complete (97268 ms)
[ERROR] Unable to continue dependency-check analysis.
[ERROR] One or more fatal errors occurred
[ERROR] No documents exist
root@N0005:~/test-app#

this is log file
``

2024-12-25 10:11:16,666 org.owasp.dependencycheck.Engine:1179
DEBUG -
org.owasp.dependencycheck.exception.NoDataException: No documents exist
        at org.owasp.dependencycheck.Engine.ensureDataExists(Engine.java:1163)
        at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:641)
        at org.owasp.dependencycheck.App.runScan(App.java:266)
        at org.owasp.dependencycheck.App.run(App.java:198)
        at org.owasp.dependencycheck.App.main(App.java:90)
2024-12-25 10:11:16,666 org.owasp.dependencycheck.data.nvdcve.CveDB:312
DEBUG - Closing database
2024-12-25 10:11:16,666 org.owasp.dependencycheck.data.nvdcve.CveDB:314
DEBUG - Cache cleared
2024-12-25 10:11:16,667 org.owasp.dependencycheck.data.nvdcve.CveDB:317
DEBUG - Connection closed
2024-12-25 10:11:16,668 org.owasp.dependencycheck.data.nvdcve.CveDB:323
DEBUG - Resources released
2024-12-25 10:11:16,668 org.owasp.dependencycheck.data.nvdcve.DriverLoader:57
DEBUG - Begin deregister driver
2024-12-25 10:11:16,668 org.owasp.dependencycheck.data.nvdcve.DriverLoader:59
DEBUG - End deregister driver
2024-12-25 10:11:16,679 org.owasp.dependencycheck.App:214
ERROR - One or more fatal errors occurred
2024-12-25 10:11:16,679 org.owasp.dependencycheck.App:220
ERROR - No documents exist
2024-12-25 10:11:16,679 org.owasp.dependencycheck.App:221
DEBUG - unexpected error
org.owasp.dependencycheck.exception.NoDataException: No documents exist
        at org.owasp.dependencycheck.Engine.ensureDataExists(Engine.java:1163)
        at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:641)
        at org.owasp.dependencycheck.App.runScan(App.java:266)
        at org.owasp.dependencycheck.App.run(App.java:198)
        at org.owasp.dependencycheck.App.main(App.java:90)
2024-12-25 10:11:16,679 org.owasp.dependencycheck.utils.Settings:936
DEBUG - Deleting ALL temporary files from `/tmp/dctempba588108-e603-470b-88ae-2d63eec36ce2`
2024-12-25 10:11:16,697 org.owasp.dependencycheck.App:91
DEBUG - Exit code: 13

this is app that i'm trying to test

root@N0005:~/test-app# ls
data  dependency-check.log  pom.xml  reports
root@N0005:~/test-app# cat pom.xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
                             http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.example</groupId>
    <artifactId>test-app</artifactId>
    <version>1.0-SNAPSHOT</version>
    <dependencies>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.12.0</version>
        </dependency>
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>31.1-jre</version>
        </dependency>
    </dependencies>
</project>
root@N0005:~/test-app#

[chadlwilson]

I believe cveb.in does not actually work properly even if it looks like it is working - and is not supported by ODC.

#7178 (comment)

#7211 (comment)

[AlSharik]

Thanks, insted of cveb.in i ll use vulnz cli mirror, also i already tested it and it worked.