Plugin is failing to download Metadata file

My Jenkins Builds started to fail over night that the plugin is not able to reach the meta data location.

[DependencyCheck] [INFO] Checking for updates [DependencyCheck] [ERROR] Unable to download meta file: https://nvd.nist.gov/feeds/json/cve/1.0/nvdcve-1.0-modified.meta; received 404 -- resource not found [DependencyCheck] org.owasp.dependencycheck.data.update.exception.UpdateException: Unable to download meta file: https://nvd.nist.gov/feeds/json/cve/1.0/nvdcve-1.0-modified.meta; received 404 -- resource not found [DependencyCheck] at org.owasp.dependencycheck.data.update.NvdCveUpdater.getMetaFile(NvdCveUpdater.java:351) [DependencyCheck] at org.owasp.dependencycheck.data.update.NvdCveUpdater.getUpdatesNeeded(NvdCveUpdater.java:385) [DependencyCheck] at org.owasp.dependencycheck.data.update.NvdCveUpdater.update(NvdCveUpdater.java:122) [DependencyCheck] at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:922) [DependencyCheck] at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:723) [DependencyCheck] at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:653) [DependencyCheck] at org.owasp.dependencycheck.App.runScan(App.java:251) [DependencyCheck] at org.owasp.dependencycheck.App.run(App.java:183) [DependencyCheck] at org.owasp.dependencycheck.App.main(App.java:80) [DependencyCheck] Caused by: org.owasp.dependencycheck.utils.ResourceNotFoundException: Requested resource does not exists - received a 404 [DependencyCheck] at org.owasp.dependencycheck.utils.HttpResourceConnection.obtainConnection(HttpResourceConnection.java:204) [DependencyCheck] at org.owasp.dependencycheck.utils.HttpResourceConnection.fetch(HttpResourceConnection.java:138) [DependencyCheck] at org.owasp.dependencycheck.utils.Downloader.fetchContent(Downloader.java:110) [DependencyCheck] at org.owasp.dependencycheck.data.update.NvdCveUpdater.getMetaFile(NvdCveUpdater.java:340) [DependencyCheck] ... 8 common frames omitted [DependencyCheck] [INFO] Skipping RetireJS update since last update was within 24 hours. [DependencyCheck] [WARN] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.

Is there any issue with the NVD NIST website?

[aboullaite]

I am using maven plugin, and updating to 6.0.1 solved the issue for me! Thanks @MSM-GabrielF

[shrimpza]

It seems as though the files have been moved to a 1.1 version/path:

https://nvd.nist.gov/vuln/data-feeds#JSON_FEED

The file https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.meta is available, while the 1.0 version is not.

There’s a changelog indicating the change:

• https://nvd.nist.gov/vuln/Data-Feeds/JSON-feed-changelog

According to this news item, they originally planned on deprecating 1.0 last year:

• https://nvd.nist.gov/General/News/JSON-1-1-Vulnerability-Feed-Release