32 lines
907 B
Markdown
32 lines
907 B
Markdown
# `OWUITOOLS_NVD_KEY` — lifts the rate limit on `lookup_cve`
|
|
|
|
Ten minutes, most of it waiting for an email. Free. **Optional**, and it matters less than
|
|
the other two.
|
|
|
|
## Why
|
|
|
|
`lookup_cve` asks CIRCL first, MITRE second, and only goes to NVD for CVSS scoring and CPE
|
|
detail. CIRCL has no hard limit, so most lookups never touch NVD at all. Keyless NVD is
|
|
documented at **5 requests per 30 seconds**, which is only a problem if you lean on the
|
|
score breakdown.
|
|
|
|
## Steps
|
|
|
|
1. Go to <https://nvd.nist.gov/developers/request-an-api-key>.
|
|
2. Fill in the form. The key arrives by email, usually within minutes.
|
|
3. Put it in `configs/owuitools.env`:
|
|
|
|
```
|
|
OWUITOOLS_NVD_KEY=...
|
|
```
|
|
|
|
4. `docker compose up -d api`
|
|
|
|
## Checking it
|
|
|
|
```sh
|
|
./tests/try-tool.sh lookup_cve '{"cve_id": "CVE-2014-0160"}' | head -10
|
|
```
|
|
|
|
You should see a CVSS vector. Without a key you still get the description and references.
|