Update Fleet to use new NVD format for vulnerabilities (CVEs)

[lukeheath]

Goal

User story
As a Fleet engineer,
I want to update our NVD CPE data feed,
so that I can continue to update CPE data in Fleet.

NOTE: This must be included in 4.41.0, as vulnerability scanning will stop working for all Fleet instances on 12/15. We need to release no later than 4.41.0 so that customers and the community have time to upgrade before 12/15.

Changes

Product

There should be no visible changes to the product as a result of this user story.

Engineering

• Evaluate NIST NVD 2.0 API.
• Spec changes necessary to ingest data from 2.0 API.
• Create and estimate sub-tasks.

Context

• Requestor(s): @lukeheath

QA

Manual testing steps

TODO @xpkoala

Testing notes

Confirmation

1. Engineer (@____): Added comment to user story confirming succesful completion of QA.
2. QA (@____): Added comment to user story confirming succesful completion of QA.

[noahtalerman]

[sharon-fdm]

Subtask 1: (immediate deploy) NVD Tool - upgrade API to get CPEs from NVD website.
estimation: 5pt

Subtask 2: (4.41) Fleet Server - upgrade the API to pull CVEs directly from NVD website
estimation: 5pt

*Can be done in parallel.

Action item: @lucasmrod set an architecture meeting.

[noahtalerman]

Mike McNeil, shared this LinkedIn post regarding a new version of CVSS (vuln severity score): CVSS v4

The post implies that NVD hasn’t yet adopted this new version:

In addition, the NVD change timeline implies they haven't adopted CVSS v4 yet:

Thus, when we switch from NVD's legacy data feed to their API as part of this story, we won’t have to make any changes to the way we’re handling CVSS.

@lucasmrod when you get the chance, can you please double to check to make sure that we don't have to change the way we're handling CVSS yet?

cc @rachaelshaw @sharon-fdm

[noahtalerman]

Feature fest: Yes, we're bringing this in to next engineering sprint. Need to answer the above.