Open Cloud Vulnerability DB RSS Processor — Design (RETIRED)
Retired 2026-08-10
This processor has been removed from the fleet. It was the second of TWO producers
for one upstream: wizsec-git clones
github.com/wiz-sec/open-cvdb and this one read cloudvulndb.org/rss/feed.xml —
the same project’s advisories, published two ways. Both set Source="opencloud"
and the same cloudvulndb.org URL shape, so their rows merged on upsert and
neither processor’s output could be attributed to it.
Counted before deciding, because “the feed has less” would have been the obvious assumption: the git repository holds 282 advisory files and the RSS feed returns 282 items. Neither reaches more than the other, so this is pure duplication rather than a coverage trade.
The git clone was kept because it reads the repository directly and is baked into the container image, so it cannot be silently truncated if the publisher shortens its feed window — a risk that applies to every RSS reader and to nothing else.
The 444 production rows under source='opencloud' are untouched; only the second
writer is gone. A useful side effect: with one writer left, that source’s efficacy
is measurable again, which it was not while two processors shared the slug.
The document is kept because the RSS parsing decisions and the CLOUD-YYYY-N
identifier minting are worth having on record if the feed ever becomes the better
path.
Overview
Fetches cloud-specific vulnerability advisories from the Open Cloud Vulnerability
Database RSS 2.0 feed (https://www.cloudvulndb.org/rss/feed.xml) and creates
first-class CVEMetadata rows (source=opencloud) with minted
CLOUD-YYYY-N identifiers.
Advisories on cloudvulndb.org do not carry CVE IDs — they use slug-based
identifiers (e.g., cve-2024-8963). Each advisory gets a unique
GCVE-110-CLOUD-YYYY-N identifier stored in GcveIssuance, with the advisory
slug linked as a GcveAlias.
Feed
| Property | Value |
|---|---|
| URL | https://www.cloudvulndb.org/rss/feed.xml |
| Auth | None — fully public |
| Format | RSS 2.0 with content:encoded namespace |
| Items | ~80+ cloud vulnerability advisories |
Parsing
| Field | Source |
|---|---|
| Advisory ID | Last path segment of <link> |
| Advisory URL | <link> (fallback: <guid>) |
| Title | <title> |
| Description | <description> (brief) |
| Content | <content:encoded> (extended, may contain HTML) |
| Cloud Provider | Extracted from title keywords: AWS, Azure, GCP, Cloudflare, etc. |
| Published | <pubDate> parsed as RFC 2822 → Unix seconds |
| Content Hash | SHA1(guid|pubDate|description) |
ID Generation
Each advisory is assigned a CLOUD-{year}-{seq} identifier:
- On startup, query
MAX(sequenceNumber)fromGcveIssuancewheregcveId LIKE 'GCVE-110-CLOUD-{year}-%' - For each new advisory, increment the sequence counter for the advisory’s publication year
- Store
CLOUD-YYYY-NasCVEMetadata.cveIdandGCVE-110-CLOUD-YYYY-NasGcveIssuance.gcveId - Link the advisory slug (e.g.,
cve-2024-8963) as aGcveAlias
Storage
No new tables or columns. All tables already exist.
| Table | Rows inserted |
|---|---|
CVEMetadata | One per advisory; source="opencloud", cveId="CLOUD-YYYY-N" |
CVEDescription | One per advisory; containerType="cna", lang="en" |
CVEMetadataReferences | One per advisory; type="advisory", referenceSource="opencloud" |
CVEAffected | One per advisory when cloud provider is identifiable |
GcveIssuance | One per advisory; gcveId="GCVE-110-CLOUD-YYYY-N" |
GcveAlias | One per advisory; links slug to GCVE ID |
Incremental Strategy
On startup, load all sourceAdvisoryRef values from CVEMetadata where
source='opencloud' into a map[string]bool. Per advisory: if the URL is in
the set and --all is false, skip. After successful processing, add the URL to
the in-memory set.
Flags
| Flag | Default | Description |
|---|---|---|
--all | false | Reprocess all advisories, not just new ones |
--limit | 0 | Maximum advisories to process per run (0 = unlimited) |
ECS Schedule
Runs daily at 09:20 UTC (cron(20 9 * * ? *)).
Key Files
| File | Purpose |
|---|---|
cmd/opencloud-rss-processor/main.go | Main processor |
internal/opencloud/types.go | RSS feed and advisory Go structs |
internal/opencloud/parser.go | Feed parsing, cloud provider detection |
internal/opencloud/mapper.go | Advisory → CVESourceData mapping |
schemas/opencloud_rss_advisory.schema.json | JSON Schema Draft 7 for parsed advisory object |
S3 Persistence
- Archive: ⚠ Not yet implemented — requires record reconstruction (DB row → canonical JSON).
- Quarantine: ⚠ Not yet implemented — same reason.
- Likely reasons when implemented:
enrich-error
This is an enrichment processor; it reads from CVEMetadata rather than ingesting raw feeds, so there is no original payload to archive verbatim. See S3 Persistence Contract § Processors whose unit-of-work is not a file.