dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java
/**
     * Updates the vulnerability within the database. If the vulnerability does
     * not exist it will be added.
     *
     * @param vuln the vulnerability to add to the database
     * @throws DatabaseException is thrown if the database
     */
Updates the vulnerability within the database. If the vulnerability does
not exist it will be added.

@param vuln the vulnerability to add to the database
@throws DatabaseException is thrown if the database
Updates the vulnerability within the database . If the vulnerability does not exist it will be added . @param vuln the vulnerability to add to the database @throws DatabaseException is thrown if the database
public synchronized void updateVulnerability(Vulnerability vuln) throws DatabaseException {
        clearCache();
        ResultSet rs = null;
        try {
            int vulnerabilityId = 0;
            final PreparedStatement selectVulnerabilityId = getPreparedStatement(SELECT_VULNERABILITY_ID);
            selectVulnerabilityId.setString(1, vuln.getName());
            rs = selectVulnerabilityId.executeQuery();
            if (rs.next()) {
                vulnerabilityId = rs.getInt(1);
                final PreparedStatement deleteReference = getPreparedStatement(DELETE_REFERENCE);
                deleteReference.setInt(1, vulnerabilityId);
                deleteReference.execute();
                final PreparedStatement deleteSoftware = getPreparedStatement(DELETE_SOFTWARE);
                deleteSoftware.setInt(1, vulnerabilityId);
                deleteSoftware.execute();
            }
            DBUtils.closeResultSet(rs);
            if (vulnerabilityId != 0) {
                if (vuln.getDescription().contains("** REJECT **")) {
                    final PreparedStatement deleteVulnerability = getPreparedStatement(DELETE_VULNERABILITY);
                    deleteVulnerability.setInt(1, vulnerabilityId);
                    deleteVulnerability.executeUpdate();
                } else {
                    final PreparedStatement updateVulnerability = getPreparedStatement(UPDATE_VULNERABILITY);
                    updateVulnerability.setString(1, vuln.getDescription());
                    updateVulnerability.setString(2, vuln.getCwe());
                    updateVulnerability.setFloat(3, vuln.getCvssScore());
                    updateVulnerability.setString(4, vuln.getCvssAccessVector());
                    updateVulnerability.setString(5, vuln.getCvssAccessComplexity());
                    updateVulnerability.setString(6, vuln.getCvssAuthentication());
                    updateVulnerability.setString(7, vuln.getCvssConfidentialityImpact());
                    updateVulnerability.setString(8, vuln.getCvssIntegrityImpact());
                    updateVulnerability.setString(9, vuln.getCvssAvailabilityImpact());
                    updateVulnerability.setInt(10, vulnerabilityId);
                    updateVulnerability.executeUpdate();
                }
            } else {
                final PreparedStatement insertVulnerability = getPreparedStatement(INSERT_VULNERABILITY);
                insertVulnerability.setString(1, vuln.getName());
                insertVulnerability.setString(2, vuln.getDescription());
                insertVulnerability.setString(3, vuln.getCwe());
                insertVulnerability.setFloat(4, vuln.getCvssScore());
                insertVulnerability.setString(5, vuln.getCvssAccessVector());
                insertVulnerability.setString(6, vuln.getCvssAccessComplexity());
                insertVulnerability.setString(7, vuln.getCvssAuthentication());
                insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact());
                insertVulnerability.setString(9, vuln.getCvssIntegrityImpact());
                insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact());
                insertVulnerability.execute();
                try {
                    rs = insertVulnerability.getGeneratedKeys();
                    rs.next();
                    vulnerabilityId = rs.getInt(1);
                } catch (SQLException ex) {
                    final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'", vuln.getName());
                    throw new DatabaseException(msg, ex);
                } finally {
                    DBUtils.closeResultSet(rs);
                }
            }
            final PreparedStatement insertReference = getPreparedStatement(INSERT_REFERENCE);
            for (Reference r : vuln.getReferences()) {
                insertReference.setInt(1, vulnerabilityId);
                insertReference.setString(2, r.getName());
                insertReference.setString(3, r.getUrl());
                insertReference.setString(4, r.getSource());
                insertReference.execute();
            }
            final PreparedStatement insertSoftware = getPreparedStatement(INSERT_SOFTWARE);
            for (VulnerableSoftware s : vuln.getVulnerableSoftware()) {
                int cpeProductId = 0;
                final PreparedStatement selectCpeId = getPreparedStatement(SELECT_CPE_ID);
                selectCpeId.setString(1, s.getName());
                try {
                    rs = selectCpeId.executeQuery();
                    if (rs.next()) {
                        cpeProductId = rs.getInt(1);
                    }
                } catch (SQLException ex) {
                    throw new DatabaseException("Unable to get primary key for new cpe: " + s.getName(), ex);
                } finally {
                    DBUtils.closeResultSet(rs);
                }
                if (cpeProductId == 0) {
                    final PreparedStatement insertCpe = getPreparedStatement(INSERT_CPE);
                    insertCpe.setString(1, s.getName());
                    insertCpe.setString(2, s.getVendor());
                    insertCpe.setString(3, s.getProduct());
                    insertCpe.executeUpdate();
                    cpeProductId = DBUtils.getGeneratedKey(insertCpe);
                }
                if (cpeProductId == 0) {
                    throw new DatabaseException("Unable to retrieve cpeProductId - no data returned");
                }
                insertSoftware.setInt(1, vulnerabilityId);
                insertSoftware.setInt(2, cpeProductId);
                if (s.getPreviousVersion() == null) {
                    insertSoftware.setNull(3, java.sql.Types.VARCHAR);
                } else {
                    insertSoftware.setString(3, s.getPreviousVersion());
                }
                try {
                    insertSoftware.execute();
                } catch (SQLException ex) {
                    if (ex.getMessage().contains("Duplicate entry")) {
                        final String msg = String.format("Duplicate software key identified in '%s:%s'", vuln.getName(), s.getName());
                        LOGGER.info(msg, ex);
                    } else {
                        throw ex;
                    }
                }
            }
        } catch (SQLException ex) {
            final String msg = String.format("Error updating '%s'", vuln.getName());
            LOGGER.debug(msg, ex);
            throw new DatabaseException(msg, ex);
        } finally {
            DBUtils.closeResultSet(rs);
        }
    }
public synchronized void updateVulnerability ( Vulnerability vuln ) throws DatabaseException { clearCache ( ) ; ResultSet rs = null ; try { int vulnerabilityId = 0 ; final PreparedStatement selectVulnerabilityId = getPreparedStatement ( SELECT_VULNERABILITY_ID ) ; selectVulnerabilityId . setString ( 1 , vuln . getName ( ) ) ; rs = selectVulnerabilityId . executeQuery ( ) ; if ( rs . next ( ) ) { vulnerabilityId = rs . getInt ( 1 ) ; final PreparedStatement deleteReference = getPreparedStatement ( DELETE_REFERENCE ) ; deleteReference . setInt ( 1 , vulnerabilityId ) ; deleteReference . execute ( ) ; final PreparedStatement deleteSoftware = getPreparedStatement ( DELETE_SOFTWARE ) ; deleteSoftware . setInt ( 1 , vulnerabilityId ) ; deleteSoftware . execute ( ) ; } DBUtils . closeResultSet ( rs ) ; if ( vulnerabilityId != 0 ) { if ( vuln . getDescription ( ) . contains ( "** REJECT **" ) ) { final PreparedStatement deleteVulnerability = getPreparedStatement ( DELETE_VULNERABILITY ) ; deleteVulnerability . setInt ( 1 , vulnerabilityId ) ; deleteVulnerability . executeUpdate ( ) ; } else { final PreparedStatement updateVulnerability = getPreparedStatement ( UPDATE_VULNERABILITY ) ; updateVulnerability . setString ( 1 , vuln . getDescription ( ) ) ; updateVulnerability . setString ( 2 , vuln . getCwe ( ) ) ; updateVulnerability . setFloat ( 3 , vuln . getCvssScore ( ) ) ; updateVulnerability . setString ( 4 , vuln . getCvssAccessVector ( ) ) ; updateVulnerability . setString ( 5 , vuln . getCvssAccessComplexity ( ) ) ; updateVulnerability . setString ( 6 , vuln . getCvssAuthentication ( ) ) ; updateVulnerability . setString ( 7 , vuln . getCvssConfidentialityImpact ( ) ) ; updateVulnerability . setString ( 8 , vuln . getCvssIntegrityImpact ( ) ) ; updateVulnerability . setString ( 9 , vuln . getCvssAvailabilityImpact ( ) ) ; updateVulnerability . setInt ( 10 , vulnerabilityId ) ; updateVulnerability . executeUpdate ( ) ; } } else { final PreparedStatement insertVulnerability = getPreparedStatement ( INSERT_VULNERABILITY ) ; insertVulnerability . setString ( 1 , vuln . getName ( ) ) ; insertVulnerability . setString ( 2 , vuln . getDescription ( ) ) ; insertVulnerability . setString ( 3 , vuln . getCwe ( ) ) ; insertVulnerability . setFloat ( 4 , vuln . getCvssScore ( ) ) ; insertVulnerability . setString ( 5 , vuln . getCvssAccessVector ( ) ) ; insertVulnerability . setString ( 6 , vuln . getCvssAccessComplexity ( ) ) ; insertVulnerability . setString ( 7 , vuln . getCvssAuthentication ( ) ) ; insertVulnerability . setString ( 8 , vuln . getCvssConfidentialityImpact ( ) ) ; insertVulnerability . setString ( 9 , vuln . getCvssIntegrityImpact ( ) ) ; insertVulnerability . setString ( 10 , vuln . getCvssAvailabilityImpact ( ) ) ; insertVulnerability . execute ( ) ; try { rs = insertVulnerability . getGeneratedKeys ( ) ; rs . next ( ) ; vulnerabilityId = rs . getInt ( 1 ) ; } catch ( SQLException ex ) { final String msg = String . format ( "Unable to retrieve id for new vulnerability for '%s'" , vuln . getName ( ) ) ; throw new DatabaseException ( msg , ex ) ; } finally { DBUtils . closeResultSet ( rs ) ; } } final PreparedStatement insertReference = getPreparedStatement ( INSERT_REFERENCE ) ; for ( Reference r : vuln . getReferences ( ) ) { insertReference . setInt ( 1 , vulnerabilityId ) ; insertReference . setString ( 2 , r . getName ( ) ) ; insertReference . setString ( 3 , r . getUrl ( ) ) ; insertReference . setString ( 4 , r . getSource ( ) ) ; insertReference . execute ( ) ; } final PreparedStatement insertSoftware = getPreparedStatement ( INSERT_SOFTWARE ) ; for ( VulnerableSoftware s : vuln . getVulnerableSoftware ( ) ) { int cpeProductId = 0 ; final PreparedStatement selectCpeId = getPreparedStatement ( SELECT_CPE_ID ) ; selectCpeId . setString ( 1 , s . getName ( ) ) ; try { rs = selectCpeId . executeQuery ( ) ; if ( rs . next ( ) ) { cpeProductId = rs . getInt ( 1 ) ; } } catch ( SQLException ex ) { throw new DatabaseException ( "Unable to get primary key for new cpe: " + s . getName ( ) , ex ) ; } finally { DBUtils . closeResultSet ( rs ) ; } if ( cpeProductId == 0 ) { final PreparedStatement insertCpe = getPreparedStatement ( INSERT_CPE ) ; insertCpe . setString ( 1 , s . getName ( ) ) ; insertCpe . setString ( 2 , s . getVendor ( ) ) ; insertCpe . setString ( 3 , s . getProduct ( ) ) ; insertCpe . executeUpdate ( ) ; cpeProductId = DBUtils . getGeneratedKey ( insertCpe ) ; } if ( cpeProductId == 0 ) { throw new DatabaseException ( "Unable to retrieve cpeProductId - no data returned" ) ; } insertSoftware . setInt ( 1 , vulnerabilityId ) ; insertSoftware . setInt ( 2 , cpeProductId ) ; if ( s . getPreviousVersion ( ) == null ) { insertSoftware . setNull ( 3 , java . sql . Types . VARCHAR ) ; } else { insertSoftware . setString ( 3 , s . getPreviousVersion ( ) ) ; } try { insertSoftware . execute ( ) ; } catch ( SQLException ex ) { if ( ex . getMessage ( ) . contains ( "Duplicate entry" ) ) { final String msg = String . format ( "Duplicate software key identified in '%s:%s'" , vuln . getName ( ) , s . getName ( ) ) ; LOGGER . info ( msg , ex ) ; } else { throw ex ; } } } } catch ( SQLException ex ) { final String msg = String . format ( "Error updating '%s'" , vuln . getName ( ) ) ; LOGGER . debug ( msg , ex ) ; throw new DatabaseException ( msg , ex ) ; } finally { DBUtils . closeResultSet ( rs ) ; } }
Updates the vulnerability within the database.
Updates the vulnerability within the database .
// first delete any existing vulnerability info. We don't know what was updated. yes, slower but atm easier.