Bug 16329

Summary:	[scarthgap] migrate from unreliable NVD API to FKIE git fetch for CVE data
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Yoann Congal <yoann.congal>
Component:	core	Assignee:	Yoann Congal <yoann.congal>
Status:	NEW ---	QA Contact:
Severity:	normal
Priority:	Medium+	CC:	ccasciato, meta.mr.watcher, meta.watcher, paul, tim.orling
Version:	5.0.22
Target Milestone:	5.0.22
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	Yes (doc changes required)

Description Yoann Congal 2026-06-22 15:25:56 UTC

NVD REST API continues to be unreliable.

A migration to the FKIE git based data feed for CVE NVD data might be worth the stable exception.

Comment 1 Yoann Congal 2026-06-22 22:44:43 UTC

A good starting point:
cve-update-db-native: add the fkie source
https://git.openembedded.org/openembedded-core/commit/?id=f6253ac8189db09fbe87141aca1733cb37a4d78f
That was later patched with: https://git.openembedded.org/openembedded-core/log/?qt=grep&q=FKIE

Comment 2 Tim Orling 2026-06-25 14:45:19 UTC

This probably needs a proposal sent to architecture and oe-core mailing lists, since we would be looking for an exception to normal stable process.