Bitbucket Dependency Scanner - Update NVD Failure

Craig Shyjak

Version: atlassian/bitbucket-dependency-scanner:0.8.0

I am passing in a valid NVD_API_KEY

Logs:

<span>[ERROR] Error updating the NVD Data</span>

<span>at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:399)</span>

<span>at org.owasp.dependencycheck.data.update.NvdApiDataSource.update(NvdApiDataSource.java:117)</span>

<span>at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:903)</span>

<span>at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:708)</span>

<span>at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:634)</span>

<span>at org.owasp.dependencycheck.App.runScan(App.java:269)</span>

<span>at org.owasp.dependencycheck.App.run(App.java:201)</span>

<span>at org.owasp.dependencycheck.App.main(App.java:93)</span>

<span>Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: Failed to parse NVD data</span>

<span>at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next(NvdCveClient.java:389)</span>

<span>at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next(NvdCveClient.java:357)</span>

<span>at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:355)</span>

<span>... 7 common frames omitted</span>

<span>Caused by: com.fasterxml.jackson.databind.JsonMappingException: Unexpected character (']' (code 93)): expected a valid value (JSON String, Number, Array, Object or token 'null', 'true' or 'false')</span>

<span>at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 2281000] (through reference chain: io.github.jeremylong.openvulnerability.client.nvd.CveApiJson20["vulnerabilities"])</span>

<span>at com.fasterxml.jackson.databind.JsonMappingException.wrapWithPath(JsonMappingException.java:401)</span>

<span>at com.fasterxml.jackson.databind.JsonMappingException.wrapWithPath(JsonMappingException.java:360)</span>

<span>at com.fasterxml.jackson.databind.deser.BeanDeserializerBase.wrapAndThrow(BeanDeserializerBase.java:1964)</span>

<span>at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:312)</span>

<span>at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177)</span>

<span>at com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue(DefaultDeserializationContext.java:342)</span>

<span>at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4917)</span>

<span>at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3860)</span>

<span>at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3828)</span>

<span>at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next(NvdCveClient.java:384)</span>

154

<span>... 9 common frames omitted</span>

Ben

Hi @Craig Shyjak 

As you're a Premium customer, you are entitled to dedicated support. As we will need access to your build environment/YAML config to troubleshoot further - a ticket is required for us to grant the necessary access:

• https://support.atlassian.com/

If you encounter issues raising a ticket - please let me know your timezone and I will raise one on your behalf with the team that operates within your region/working hours.

Cheers!

- Ben (Bitbucket Cloud Support)