OSVDB replacements

[wireghoul]

With OSVDB shutting down the identifiers will no longer be helpful when trying to assess a nikto finding. Hopefully valid counter parts can be found for most (all?) of the existing OSVDB ids.

[sullo]

I have some stashed code (I think) to turn the OSVDB field into general reference field. We'll just need a mapping (I believe CVE has one for many OSVDB refs). I didn't implement because it's a major change and should probably be in a full new release (which should also fix updating). And also because I don't like the limitation of one ref/url in that field, and don't like to have nested csv...

[l0nedigit]

Sullo, just wanted to follow up on this. Is there anything on the roadmap to address this? Realize it's been a long time since this issue was put in, just ran into a use case recently where having the CVE would be beneficial. Considering the osvdb.org shut down and is now a paid subscription service (VulnDB), it'd be nice if the tool continued to utilize open source standards.

Perhaps I could help out with the migration?

[sullo]

OSVDB references will now point to vulners.com which has a pretty good archive of them which are in turn cross-referenced.

Did some additional prep work to move away from OSVDB as the unique reference.

[l0nedigit]

Thanks, pulled the latest code and XML output now showing vulners as a reference to applicable OSVDB ID's.

[sullo]

Closing this bug as it is resolved in the 2.5.0 branch, even though there are still quite a few osvdb references. Any remaining will point to a potential mirror for a URL, and it will be ongoing work to eliminate them all.