NVD seems to require version 2.0 API

[Jaap Prickartz]

the current code doesn't succeed in downloading the CVE db. I changed a few lines in order to use the 2.0 version of the API. The datamodel of the respons seems to have changed as well, my change does not take multiple configuration keys into account. Hope it helps someone!

diff --git a/query_nvd.py b/query_nvd.py
index 7d18c85..19f0a54 100644
--- a/query_nvd.py
+++ b/query_nvd.py
@@ -61,17 +61,19 @@ class CVEsInterface():
 
     def get_cves(self, product, vendor, resultsPerPage, cur_index):
         total_results = 0
-        response = self._web_api_query("https://services.nvd.nist.gov/rest/json/cves/1.0?",
-                                       params={"keyword": product, "resultsPerPage": resultsPerPage,
+        response = self._web_api_query("https://services.nvd.nist.gov/rest/json/cves/2.0?",
+                                       params={"keywordSearch": product, "resultsPerPage": resultsPerPage,
                                                "startIndex": cur_index})
         if response:
-            self._convert_to_ranges(response["result"]["CVE_Items"], vendor, product)
+            # self._convert_to_ranges(response["result"]["CVE_Items"], vendor, product)
+            self._convert_to_ranges(response["vulnerabilities"], vendor, product)
             total_results = response["totalResults"]
         return total_results
 
     def _convert_to_ranges(self, all_cves_data, vendor, product):
         for cve_data in all_cves_data:
-            cve = cve_data["cve"]['CVE_data_meta']['ID']
+            cve_data = cve_data['cve']
+            cve = cve_data['id']
 
             if cve in self._ver_cves.keys():
                 continue
@@ -79,15 +81,15 @@ class CVEsInterface():
             if 'configurations' not in cve_data:
                 print (f'ERROR: No configurations {cve}', file = sys.stderr)
             else:
-                if 'nodes' not in cve_data['configurations']:
+                if 'nodes' not in cve_data['configurations'][0]:
                     print (f'ERROR: No nodes {cve}', file = sys.stderr)
                 else:
                     versions = []
-                    for node in cve_data['configurations']['nodes']:
+                    for node in cve_data['configurations'][0]['nodes']:
                         if node['operator'] != 'OR':
                             print(f'DEBUG: No handling for OR operator in node, the following CVE needs to be implemented: {cve}', file=sys.stderr)
                         else:
-                            for cpe_match in node['cpe_match']:
+                            for cpe_match in node['cpeMatch']:
                                 cpe_res = hashabledict()
                                 if 'cpe23Uri' in cpe_match:
                                     if not f'{vendor}:{product}' in cpe_match['cpe23Uri']: