No EPSS data/ mirroring not working?

[joh-nnyS]

I'm running into an issue with dependency track 4.11.7, where it doesn't download EPSS data. epss.cyentia.com was initially blocked by our corporate Firewall, but should be accessible now from our dependency track server (can be pinged and curled etc,). Mirroring should be enabled (see config below) I see no mention in the logs that EPSS mirroring is being attempted.

Is there any way to manually trigger mirroring or to delete and redownload databases?

related config:

{
"groupName": "vuln-source",
"propertyName": "epss.enabled",
"propertyValue": "true",
"propertyType": "BOOLEAN",
"description": "Flag to enable/disable Exploit Prediction Scoring System"
},
{
"groupName": "vuln-source",
"propertyName": "epss.feeds.url",
"propertyValue": "https://epss.cyentia.com",
"propertyType": "URL",
"description": "A base URL pointing to the hostname and path of the EPSS feeds"
},

NVD mirroring is enabled and happens regularly:

{
"groupName": "vuln-source",
"propertyName": "nvd.api.download.feeds",
"propertyValue": "true",
"propertyType": "BOOLEAN",
"description": "Whether to download feed files even though mirroring via REST API is enabled"
},
{
"groupName": "vuln-source",
"propertyName": "nvd.api.enabled",
"propertyValue": "true",
"propertyType": "BOOLEAN",
"description": "Whether to enable NVD mirroring via REST API"
},
{
"groupName": "vuln-source",
"propertyName": "nvd.api.key",
"propertyValue": "HiddenDecryptedPropertyPlaceholder",
"propertyType": "ENCRYPTEDSTRING",
"description": "API key for the NVD REST API"
},
{
"groupName": "vuln-source",
"propertyName": "nvd.api.last.modified.epoch.seconds",
"propertyValue": "0",
"propertyType": "INTEGER",
"description": "Epoch timestamp in seconds of the latest observed CVE modification time"
},
{
"groupName": "vuln-source",
"propertyName": "nvd.api.url",
"propertyValue": "https://services.nvd.nist.gov/rest/json/cves/2.0",
"propertyType": "URL",
"description": "REST API URL for the NVD's CVE API 2.0"
},
{
"groupName": "vuln-source",
"propertyName": "nvd.enabled",
"propertyValue": "true",
"propertyType": "BOOLEAN",
"description": "Flag to enable/disable National Vulnerability Database"
},
{
"groupName": "vuln-source",
"propertyName": "nvd.feeds.url",
"propertyValue": "https://nvd.nist.gov/feeds",
"propertyType": "URL",
"description": "A base URL pointing to the hostname and path of the NVD feeds"
}

apiserver logs:

024-08-19 06:44:52,265 INFO [EmbeddedJettyServer] alpine-executable-war v2.2.5 (c3a1a709-acdc-4ca7-96dd-5eaab858ee32) built on: 2024-02-29T20:30:01Z
2024-08-19 06:44:53,512 INFO [Config] --------------------------------------------------------------------------------
2024-08-19 06:44:53,513 INFO [Config] OS Name: Linux
2024-08-19 06:44:53,514 INFO [Config] OS Version: 6.8.0-40-generic
2024-08-19 06:44:53,514 INFO [Config] OS Arch: amd64
2024-08-19 06:44:53,514 INFO [Config] CPU Cores: 4
2024-08-19 06:44:53,515 INFO [Config] Max Memory: 9.6 GB (10,309,074,944.0 bytes)
2024-08-19 06:44:53,516 INFO [Config] Java Vendor: Eclipse Adoptium
2024-08-19 06:44:53,517 INFO [Config] Java Version: 21.0.4+7-LTS
2024-08-19 06:44:53,517 INFO [Config] Java Home: /opt/java/openjdk
2024-08-19 06:44:53,517 INFO [Config] Java Temp: /tmp
2024-08-19 06:44:53,517 INFO [Config] User: dtrack
2024-08-19 06:44:53,517 INFO [Config] User Home: /data/
2024-08-19 06:44:53,517 INFO [Config] --------------------------------------------------------------------------------
2024-08-19 06:44:53,517 INFO [Config] Initializing Configuration
2024-08-19 06:44:53,518 INFO [Config] System property alpine.application.properties not specified
2024-08-19 06:44:53,518 INFO [Config] Loading application.properties from classpath
2024-08-19 06:44:53,521 INFO [Config] --------------------------------------------------------------------------------
2024-08-19 06:44:53,521 INFO [Config] Application: Dependency-Track
2024-08-19 06:44:53,521 INFO [Config] Version: 4.11.7
2024-08-19 06:44:53,522 INFO [Config] Built-on: 2024-08-14T12:37:10Z
2024-08-19 06:44:53,522 INFO [Config] --------------------------------------------------------------------------------
2024-08-19 06:44:53,522 INFO [Config] Framework: Alpine
2024-08-19 06:44:53,522 INFO [Config] Version : 2.2.5
2024-08-19 06:44:53,522 INFO [Config] Built-on: 2024-02-29T20:30:01Z
2024-08-19 06:44:53,522 INFO [Config] --------------------------------------------------------------------------------
2024-08-19 06:44:53,573 INFO [RequirementsVerifier] Initializing requirements verifier
2024-08-19 06:44:53,573 INFO [UpgradeInitializer] Initializing upgrade framework
2024-08-19 06:44:56,323 INFO [PersistenceManagerFactory] Initializing persistence framework
2024-08-19 06:44:56,325 INFO [PersistenceManagerFactory] Creating transactional connection pool
2024-08-19 06:44:56,383 INFO [PersistenceManagerFactory] Creating non-transactional connection pool
2024-08-19 06:44:56,543 INFO [HealthCheckInitializer] Registering health checks
2024-08-19 06:44:56,546 INFO [DefaultObjectGenerator] Initializing default object generator
2024-08-19 06:44:56,547 INFO [DefaultObjectGenerator] Synchronizing permissions to datastore
2024-08-19 06:44:56,775 INFO [DefaultObjectGenerator] Synchronizing SPDX license definitions to datastore
2024-08-19 06:44:58,908 INFO [DefaultObjectGenerator] Synchronizing default repositories to datastore
2024-08-19 06:44:58,920 INFO [DefaultObjectGenerator] Synchronizing config properties to datastore
2024-08-19 06:44:58,951 INFO [DefaultObjectGenerator] Synchronizing notification publishers to datastore
2024-08-19 06:44:59,028 INFO [EventSubsystemInitializer] Initializing asynchronous event subsystem
2024-08-19 06:44:59,047 INFO [NotificationSubsystemInitializer] Initializing notification service
2024-08-19 06:44:59,048 INFO [IndexSubsystemInitializer] Building lucene indexes if required
2024-08-19 06:44:59,059 INFO [IndexManager] Checking the health of index PROJECT
2024-08-19 06:44:59,191 INFO [IndexManager] The index PROJECT is healthy
2024-08-19 06:44:59,192 INFO [IndexManager] Checking the health of index COMPONENT
2024-08-19 06:44:59,244 INFO [IndexManager] The index COMPONENT is healthy
2024-08-19 06:44:59,244 INFO [IndexManager] Checking the health of index SERVICECOMPONENT
2024-08-19 06:44:59,246 INFO [IndexManager] The index SERVICECOMPONENT is healthy
2024-08-19 06:44:59,246 INFO [IndexManager] Checking the health of index VULNERABILITY
2024-08-19 06:45:02,287 INFO [IndexManager] The index VULNERABILITY is healthy
2024-08-19 06:45:02,287 INFO [IndexManager] Checking the health of index LICENSE
2024-08-19 06:45:02,293 INFO [IndexManager] The index LICENSE is healthy
2024-08-19 06:45:02,293 INFO [IndexManager] Checking the health of index VULNERABLESOFTWARE
2024-08-19 06:45:03,305 INFO [IndexManager] The index VULNERABLESOFTWARE is healthy
2024-08-19 06:45:03,321 INFO [AlpineServlet] Starting Dependency-Track
2024-08-19 06:45:05,006 INFO [AlpineServlet] Dependency-Track is ready
2024-08-19 06:45:05,009 INFO [NvdMirrorServlet] Initializing NVD mirror
2024-08-19 06:45:05,009 INFO [FileSystemResourceServlet] Initializing filesystem resource servlet
2024-08-19 06:45:06,440 INFO [UserResource] Successful user login / username: Johann.Seebeck / IP Address: 172.18.0.4 / User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0
2024-08-19 06:45:06,460 INFO [UserResource] Successful user login / username: Johann.Seebeck / IP Address: 172.18.0.4 / User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0
2024-08-19 06:45:09,048 INFO [PortfolioMetricsUpdateTask] Executing portfolio metrics update
2024-08-19 06:45:09,048 INFO [VulnerabilityMetricsUpdateTask] Executing metrics update on vulnerability database
2024-08-19 06:45:09,064 INFO [ProjectMetricsUpdateTask] Executing metrics update for project b235c674-dfe6-4c5e-8031-85c783dd3f9c
2024-08-19 06:45:09,064 INFO [ProjectMetricsUpdateTask] Executing metrics update for project ea94e15c-ab91-4cdc-8ddf-6a510ba9f31c
2024-08-19 06:45:09,069 INFO [ProjectMetricsUpdateTask] Executing metrics update for project b6627f07-6f15-4735-9166-e49bd72f91f0
2024-08-19 06:45:09,073 INFO [ProjectMetricsUpdateTask] Executing metrics update for project 1852767f-79ff-4b85-9e77-eaac97dc8942
2024-08-19 06:45:09,077 INFO [ClearComponentAnalysisCacheTask] Clearing ComponentAnalysisCache
2024-08-19 06:45:09,078 INFO [OsvDownloadTask] Google OSV mirroring is disabled. No ecosystem selected.
2024-08-19 06:45:09,088 INFO [ClearComponentAnalysisCacheTask] Complete
2024-08-19 06:45:09,725 INFO [ProjectMetricsUpdateTask] Executing metrics update for project 2f0e23a2-2a42-41c0-8bfd-e4cca9388546
2024-08-19 06:45:09,944 INFO [PortfolioMetricsUpdateTask] Completed portfolio metrics update in 00:00:896
2024-08-19 06:45:10,413 INFO [VulnerabilityMetricsUpdateTask] Completed metrics update on vulnerability database in 00:01:365
2024-08-19 06:45:59,047 INFO [VulnDbSyncTask] Starting VulnDB mirror synchronization task
2024-08-19 06:45:59,047 INFO [VulnDbSyncTask] VulnDB mirror directory does not exist. Skipping.
2024-08-19 06:45:59,047 INFO [NistMirrorTask] Starting NIST mirroring task
2024-08-19 06:45:59,048 INFO [NistMirrorTask] Downloading files at Mon Aug 19 06:45:59 UTC 2024
2024-08-19 06:45:59,049 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2024.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:45:59,049 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2024.meta
2024-08-19 06:45:59,057 INFO [NistApiMirrorTask] CVEs were not previously mirrored via NVD API; Will mirror all CVEs
2024-08-19 06:45:59,719 INFO [NistMirrorTask] Downloading...
2024-08-19 06:45:59,723 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2023.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:45:59,724 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2023.meta
2024-08-19 06:45:59,827 INFO [NistMirrorTask] Downloading...
2024-08-19 06:45:59,829 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2022.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:45:59,830 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2022.meta
2024-08-19 06:45:59,934 INFO [NistMirrorTask] Downloading...
2024-08-19 06:45:59,936 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2021.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:45:59,936 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2021.meta
2024-08-19 06:46:00,039 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:00,041 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2020.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:00,042 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2020.meta
2024-08-19 06:46:00,146 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:00,149 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2019.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:00,149 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2019.meta
2024-08-19 06:46:00,252 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:00,254 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2018.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:00,254 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2018.meta
2024-08-19 06:46:00,312 ERROR [NistApiMirrorTask] An unexpected error occurred while mirroring the contents of the National Vulnerability Database
io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 404
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next(NvdCveClient.java:373)
at org.dependencytrack.tasks.NistApiMirrorTask.inform(NistApiMirrorTask.java:157)
at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:110)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)
2024-08-19 06:46:00,312 INFO [NistApiMirrorTask] Mirroring of 0 CVEs completed in PT1.257271129S
2024-08-19 06:46:00,357 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:00,360 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2017.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:00,360 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2017.meta
2024-08-19 06:46:00,464 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:00,467 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2016.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:00,467 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2016.meta
2024-08-19 06:46:00,573 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:00,580 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2015.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:00,580 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2015.meta
2024-08-19 06:46:00,685 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:00,687 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2014.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:00,687 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2014.meta
2024-08-19 06:46:00,793 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:00,794 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2013.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:00,794 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2013.meta
2024-08-19 06:46:00,901 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:00,903 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2012.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:00,903 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2012.meta
2024-08-19 06:46:01,006 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:01,008 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2011.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:01,008 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2011.meta
2024-08-19 06:46:01,113 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:01,115 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2010.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:01,115 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2010.meta
2024-08-19 06:46:01,220 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:01,222 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2009.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:01,223 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2009.meta
2024-08-19 06:46:01,327 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:01,330 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2008.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:01,330 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2008.meta
2024-08-19 06:46:01,433 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:01,436 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2007.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:01,436 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2007.meta
2024-08-19 06:46:01,540 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:01,541 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2006.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:01,541 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2006.meta
2024-08-19 06:46:01,645 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:01,647 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2005.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:01,647 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2005.meta
2024-08-19 06:46:01,750 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:01,752 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2004.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:01,752 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2004.meta
2024-08-19 06:46:01,855 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:01,856 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2003.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:01,857 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2003.meta
2024-08-19 06:46:01,960 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:01,961 INFO [NistMirrorTask] Retrieval of nvdcve-1.1-2002.json.gz not necessary. Will use modified feed for updates.
2024-08-19 06:46:01,961 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2002.meta
2024-08-19 06:46:02,065 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:02,171 INFO [NistMirrorTask] Using cached version of nvdcve-1.1-modified.json.gz
2024-08-19 06:46:02,172 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.meta
2024-08-19 06:46:02,275 INFO [NistMirrorTask] Downloading...
2024-08-19 06:46:02,278 INFO [NistMirrorTask] NIST mirroring complete
2024-08-19 06:46:02,278 INFO [NistMirrorTask] Time spent (d/l): 3063ms
2024-08-19 06:46:02,278 INFO [NistMirrorTask] Time spent (total): 3231ms

[joh-nnyS]

I've tried disabling and enabling EPSS-Mirroring via the API in the hope that this would retrigger mirroring, but no luck.

[joh-nnyS]

Full reinstall of the server, did the trick.