CVE Onboarding Timeline

[theinfosecguy]

I'm working on implementing Google OSV & have a couple of questions regarding Google OSV:

• How long does it take to onboard a CVE to the OSV vulnerability database?
• Is the CVE data onboarded from NVD or other sources as well?

[andrewpollock]

Hello,

I think this is more of an osv.dev question than an OSV Scanner one, so I'll try and field it.

You've said "CVE" specifically, so I'm going to assume you're talking about CVEs and CVEs only (as opposed to OSV records we import from our current data sources.

Today, osv.dev doesn't import CVEs at all.

I'm working on a project to convert select CVEs from the NVD into OSV records (being tracked in google/osv.dev#783)

If you're wondering how CVEs wind up being referenced on OSV records, it's because the source record has the CVE specified as an alias.

More generally, the service level objectives we are targeting around things like import latency are documented at https://google.github.io/osv.dev/faq/#what-are-osvs-service-level-objectives-slos

I hope this answers your question adequately, if not, please reopen and clarify your question a little more for me.