From 96818686f40c42ad850e0a8de6179d289fd91ee6 Mon Sep 17 00:00:00 2001
From: Jeremy Long <jeremy.long@gmail.com>
Date: Sun, 8 Oct 2023 07:04:34 -0400
Subject: [PATCH] feat: NVD API data feed

---
 core/pom.xml                                  |    6 +-
 .../data/nvd/json/MetaProperties.java         |    1 +
 .../data/nvdcve/DatabaseProperties.java       |   61 +-
 .../data/update/NvdApiDataSource.java         |  296 ++++-
 .../data/update/NvdCveUpdater.java            | 1015 +++++++++--------
 .../data/update/nvd/DownloadTask.java         |  144 +--
 .../data/update/nvd/NvdCveInfo.java           |    8 +-
 .../data/update/nvd/ProcessTask.java          |   31 +-
 .../data/update/nvd/api/NvdApiProcessor.java  |   17 +-
 .../owasp/dependencycheck/utils/DateUtil.java |   18 +
 .../main/resources/dependencycheck.properties |    7 +
 .../data/nvdcve/DatabasePropertiesIT.java     |   16 -
 .../data/update/NvdCveUpdaterIT.java          |   43 -
 .../data/update/nvd/DownloadTaskTest.java     |   46 -
 .../data/update/nvd/NvdCveInfoTest.java       |   63 -
 pom.xml                                       |    5 +
 .../owasp/dependencycheck/utils/Settings.java |   70 +-
 17 files changed, 975 insertions(+), 872 deletions(-)
 delete mode 100644 core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIT.java
 delete mode 100644 core/src/test/java/org/owasp/dependencycheck/data/update/nvd/DownloadTaskTest.java
 delete mode 100644 core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfoTest.java

diff --git a/core/pom.xml b/core/pom.xml
index 3df2083e0f9..58f783a3bed 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -105,7 +105,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
                 <artifactId>jsonschema2pojo-maven-plugin</artifactId>
 
                 <executions>
-<!--                    <execution>
+                    <!--                    <execution>
                         <id>generate-nvd</id>
                         <phase>generate-sources</phase>
                         <goals>
@@ -289,6 +289,10 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.datatype</groupId>
+            <artifactId>jackson-datatype-jsr310</artifactId>
+        </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.module</groupId>
             <artifactId>jackson-module-afterburner</artifactId>
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/MetaProperties.java b/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/MetaProperties.java
index 322ba5c02da..7582ed16001 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/MetaProperties.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nvd/json/MetaProperties.java
@@ -31,6 +31,7 @@
  *
  * @author Jeremy Long
  */
+@Deprecated
 public class MetaProperties {
 
     /**
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
index a039ff96aa8..cad93a15823 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
@@ -27,7 +27,6 @@
 import java.util.TreeMap;
 import javax.annotation.concurrent.ThreadSafe;
 
-import org.owasp.dependencycheck.data.update.nvd.NvdCveInfo;
 import org.owasp.dependencycheck.data.update.exception.UpdateException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -50,13 +49,10 @@ public class DatabaseProperties {
      * The last modified request data for the NVD API.
      */
     public static final String NVD_API_LAST_MODIFIED = "nvd.api.last.modified";
-    /**
-     * The properties file key for the last checked field - used to store the
-     * last check time.
-     */
-    public static final String NVD_LAST_CHECKED = "nvd.api.last.checked";
 
-    public static final String NVD_CACHE_LAST_MODIFIED_BASE = "nvd.cache.last.modified";
+    public static final String NVD_CACHE_LAST_CHECKED = "nvd.cache.last.checked";
+
+    public static final String NVD_CACHE_LAST_MODIFIED = "nvd.cache.last.modified";
 
     // TODO DELETE START--------------------------------------------------------
     /**
@@ -64,16 +60,7 @@ public class DatabaseProperties {
      * file (i.e. the containing the last 8 days of updates)..
      */
     public static final String MODIFIED = "Modified";
-    /**
-     * The properties file key for the last checked field - used to store the
-     * last check time of the Modified NVD CVE xml file.
-     */
-    public static final String LAST_CHECKED = "NVD CVE Checked";
-    /**
-     * The properties file key for the last updated field - used to store the
-     * last updated time of the Modified NVD CVE xml file.
-     */
-    public static final String LAST_UPDATED = "NVD CVE Modified";
+
     /**
      * Stores the last updated time for each of the NVD CVE files. These
      * timestamps should be updated if we process the modified file within 7
@@ -128,19 +115,6 @@ public synchronized boolean isEmpty() {
         return properties == null || properties.isEmpty();
     }
 
-    /**
-     * Saves the last updated information to the properties file.
-     *
-     * @param updatedValue the updated NVD CVE entry
-     * @throws UpdateException is thrown if there is an update exception
-     */
-    public synchronized void save(NvdCveInfo updatedValue) throws UpdateException {
-        if (updatedValue == null) {
-            return;
-        }
-        save(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
-    }
-
     /**
      * Saves the key value pair to the properties store.
      *
@@ -214,7 +188,7 @@ public synchronized Map<String, String> getMetaData() {
         }
         return map;
     }
-    
+
     /**
      * Retrieves a zoned date time.
      *
@@ -222,12 +196,7 @@ public synchronized Map<String, String> getMetaData() {
      * @return the zoned date time
      */
     public ZonedDateTime getTimestamp(String key) {
-        DateTimeFormatter dtf = DateTimeFormatter.ofPattern("uuuu-MM-dd'T'HH:mm:ssX");
-        if (properties.contains(key)) {
-            String value = properties.getProperty(key);
-            return ZonedDateTime.parse(value, dtf);
-        }
-        return null;
+        return DatabaseProperties.getTimestamp(properties,key);
     }
 
     /**
@@ -240,4 +209,22 @@ public void save(String key, ZonedDateTime timestamp) throws UpdateException {
         DateTimeFormatter dtf = DateTimeFormatter.ofPattern("uuuu-MM-dd'T'HH:mm:ssX");
         save(key, dtf.format(timestamp));
     }
+
+    
+    /**
+     * Retrieves a zoned date time.
+     *
+     * @param properties the properties file containing the date time
+     * @param key the property key
+     * @return the zoned date time
+     */
+    public static ZonedDateTime getTimestamp(Properties properties, String key) {
+        DateTimeFormatter dtf = DateTimeFormatter.ofPattern("uuuu-MM-dd'T'HH:mm:ssX");
+        if (properties.contains(key)) {
+            String value = properties.getProperty(key);
+            return ZonedDateTime.parse(value, dtf);
+        }
+        return null;
+    }
+
 }
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/NvdApiDataSource.java b/core/src/main/java/org/owasp/dependencycheck/data/update/NvdApiDataSource.java
index 6250e5a0ee2..6277f4870e2 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/NvdApiDataSource.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/NvdApiDataSource.java
@@ -24,21 +24,39 @@
 import io.github.jeremylong.openvulnerability.client.nvd.NvdCveClientBuilder;
 import java.io.File;
 import java.io.IOException;
+import java.io.StringReader;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.time.Duration;
+import java.time.ZoneId;
 import java.time.ZonedDateTime;
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.Set;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
 import org.owasp.dependencycheck.Engine;
 import org.owasp.dependencycheck.data.nvdcve.CveDB;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
 import org.owasp.dependencycheck.data.update.exception.UpdateException;
+import org.owasp.dependencycheck.data.update.nvd.DownloadTask;
+import org.owasp.dependencycheck.data.update.nvd.ProcessTask;
 import org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor;
+import org.owasp.dependencycheck.utils.DateUtil;
+import org.owasp.dependencycheck.utils.DownloadFailedException;
+import org.owasp.dependencycheck.utils.Downloader;
 import org.owasp.dependencycheck.utils.InvalidSettingException;
+import org.owasp.dependencycheck.utils.ResourceNotFoundException;
 import org.owasp.dependencycheck.utils.Settings;
+import org.owasp.dependencycheck.utils.TooManyRequestsException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -69,6 +87,8 @@ public class NvdApiDataSource implements CachedWebDataSource {
      */
     private DatabaseProperties dbProperties = null;
 
+    private static final String NVD_API_CACHE_MODIFIED_DATE = "lastModifiedDate";
+
     @Override
     public boolean update(Engine engine) throws UpdateException {
         this.settings = engine.getSettings();
@@ -78,6 +98,157 @@ public boolean update(Engine engine) throws UpdateException {
         }
         dbProperties = cveDb.getDatabaseProperties();
 
+        String nvdDataFeedUrl = settings.getString(Settings.KEYS.NVD_API_DATAFEED_URL);
+        if (nvdDataFeedUrl != null) {
+            return processDatafeed(nvdDataFeedUrl);
+        }
+        return processApi();
+    }
+
+    private boolean processDatafeed(String nvdDataFeedUrl) throws UpdateException {
+        boolean updatesMade = false;
+        try {
+            dbProperties = cveDb.getDatabaseProperties();
+            if (checkUpdate()) {
+                String url = settings.getString(Settings.KEYS.NVD_API_DATAFEED_URL);
+                if (url == null) {
+                    throw new UpdateException("NVD API Cache URL was not provided");
+                }
+                if (!url.endsWith("/")) {
+                    url += "/";
+                }
+                final Properties cacheProperties = getRemoteCacheProperties(url);
+                final ZonedDateTime now = ZonedDateTime.now(ZoneId.of("UTC"));
+                final Map<String, String> updateable = getUpdatesNeeded(url, cacheProperties, now);
+                if (!updateable.isEmpty()) {
+                    final int downloadPoolSize;
+                    final int max = settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 1);
+                    downloadPoolSize = Math.min(Runtime.getRuntime().availableProcessors(), max);
+
+                    ExecutorService processingExecutorService = null;
+                    ExecutorService downloadExecutorService = null;
+                    try {
+                        downloadExecutorService = Executors.newFixedThreadPool(downloadPoolSize);
+                        processingExecutorService = Executors.newFixedThreadPool(PROCESSING_THREAD_POOL_SIZE);
+
+                        DownloadTask runLast = null;
+                        final Set<Future<Future<NvdApiProcessor>>> downloadFutures = new HashSet<>(updateable.size());
+                        runLast = startDownloads(updateable, processingExecutorService, runLast, downloadFutures, downloadExecutorService);
+
+                        //complete downloads
+                        final Set<Future<NvdApiProcessor>> processFutures = new HashSet<>(updateable.size());
+                        for (Future<Future<NvdApiProcessor>> future : downloadFutures) {
+                            processDownload(future, processFutures);
+                        }
+                        //process the data
+                        processFuture(processFutures);
+                        processFutures.clear();
+
+                        //download and process the modified as the last entry
+                        if (runLast != null) {
+                            final Future<Future<NvdApiProcessor>> modified = downloadExecutorService.submit(runLast);
+                            processDownload(modified, processFutures);
+                            processFuture(processFutures);
+                        }
+
+                    } finally {
+                        if (processingExecutorService != null) {
+                            processingExecutorService.shutdownNow();
+                        }
+                        if (downloadExecutorService != null) {
+                            downloadExecutorService.shutdownNow();
+                        }
+                    }
+                    updatesMade = true;
+                }
+                storeLastModifiedDates(now, cacheProperties, updateable);
+                dbProperties.save(url, url);
+                if (updatesMade) {
+                    cveDb.persistEcosystemCache();
+                }
+                final int updateCount = cveDb.updateEcosystemCache();
+                LOGGER.debug("Corrected the ecosystem for {} ecoSystemCache entries", updateCount);
+                if (updatesMade || updateCount > 0) {
+                    cveDb.cleanupDatabase();
+                }
+            }
+        } catch (UpdateException ex) {
+            if (ex.getCause() != null && ex.getCause() instanceof DownloadFailedException) {
+                final String jre = System.getProperty("java.version");
+                if (jre == null || jre.startsWith("1.4") || jre.startsWith("1.5") || jre.startsWith("1.6") || jre.startsWith("1.7")) {
+                    LOGGER.error("An old JRE is being used ({} {}), and likely does not have the correct root certificates or algorithms "
+                            + "to connect to the NVD - consider upgrading your JRE.", System.getProperty("java.vendor"), jre);
+                }
+            }
+            throw ex;
+        } catch (DatabaseException ex) {
+            throw new UpdateException("Database Exception, unable to update the data to use the most current data.", ex);
+        }
+        return updatesMade;
+    }
+
+    private void storeLastModifiedDates(final ZonedDateTime now, final Properties cacheProperties, final Map<String, String> updateable) throws UpdateException {
+        dbProperties.save(DatabaseProperties.NVD_CACHE_LAST_CHECKED, now);
+        dbProperties.save(DatabaseProperties.NVD_CACHE_LAST_MODIFIED, DatabaseProperties.getTimestamp(cacheProperties, NVD_API_CACHE_MODIFIED_DATE + ".modified"));
+        for (String entry : updateable.keySet()) {
+            ZonedDateTime date = DatabaseProperties.getTimestamp(cacheProperties, NVD_API_CACHE_MODIFIED_DATE + "." + entry);
+            dbProperties.save(DatabaseProperties.NVD_CACHE_LAST_MODIFIED + "." + entry, date);
+        }
+    }
+
+    private DownloadTask startDownloads(final Map<String, String> updateable, ExecutorService processingExecutorService, DownloadTask runLast, final Set<Future<Future<NvdApiProcessor>>> downloadFutures, ExecutorService downloadExecutorService) throws UpdateException {
+        for (Map.Entry<String, String> cve : updateable.entrySet()) {
+            final DownloadTask call = new DownloadTask(cve.getValue(), processingExecutorService, cveDb, settings);
+            if (call.isModified()) {
+                runLast = call;
+            } else {
+                final boolean added = downloadFutures.add(downloadExecutorService.submit(call));
+                if (!added) {
+                    throw new UpdateException("Unable to add the download task for " + cve);
+                }
+            }
+        }
+        return runLast;
+    }
+
+    private void processFuture(final Set<Future<NvdApiProcessor>> processFutures) throws UpdateException {
+        //complete processing
+        for (Future<NvdApiProcessor> future : processFutures) {
+            try {
+                final NvdApiProcessor task = future.get();
+                //TODO - do we need to check for errors?
+//                                if (task.getException() != null) {
+//                                    throw task.getException();
+//                                }
+            } catch (InterruptedException ex) {
+                LOGGER.debug("Thread was interrupted during processing", ex);
+                Thread.currentThread().interrupt();
+                throw new UpdateException(ex);
+            } catch (ExecutionException ex) {
+                LOGGER.debug("Execution Exception during process", ex);
+                throw new UpdateException(ex);
+            }
+        }
+    }
+
+    private void processDownload(Future<Future<NvdApiProcessor>> future, final Set<Future<NvdApiProcessor>> processFutures) throws UpdateException {
+        final Future<NvdApiProcessor> task;
+        try {
+            task = future.get();
+            if (task != null) {
+                processFutures.add(task);
+            }
+        } catch (InterruptedException ex) {
+            LOGGER.debug("Thread was interrupted during download", ex);
+            Thread.currentThread().interrupt();
+            throw new UpdateException("The download was interrupted", ex);
+        } catch (ExecutionException ex) {
+            LOGGER.debug("Thread was interrupted during download execution", ex);
+            throw new UpdateException("The execution of the download was interrupted", ex);
+        }
+    }
+
+    private boolean processApi() throws UpdateException {
         ZonedDateTime lastModifiedRequest = dbProperties.getTimestamp(DatabaseProperties.NVD_API_LAST_MODIFIED);
         NvdCveClientBuilder builder = NvdCveClientBuilder.aNvdCveApi();
         if (lastModifiedRequest != null) {
@@ -122,7 +293,6 @@ public boolean update(Engine engine) throws UpdateException {
 
             try {
                 for (Future f : submitted) {
-                    LOGGER.error("updating");
                     while (!f.isDone()) {
                         Thread.sleep(500);
                     }
@@ -194,4 +364,128 @@ public boolean purge(Engine engine) {
         return result;
     }
 
+    /**
+     * Checks if the NVD API Cache JSON files were last checked recently. As an
+     * optimization, we can avoid repetitive checks against the NVD cache.
+     *
+     * @return true to proceed with the check, or false to skip
+     * @throws UpdateException thrown when there is an issue checking for
+     * updates
+     */
+    private boolean checkUpdate() throws UpdateException {
+        boolean proceed = true;
+        // If the valid setting has not been specified, then we proceed to check...
+        final int validForHours = settings.getInt(Settings.KEYS.NVD_API_VALID_FOR_HOURS, 0);
+        if (dataExists() && 0 < validForHours) {
+            // ms Valid = valid (hours) x 60 min/hour x 60 sec/min x 1000 ms/sec
+            final long validForSeconds = validForHours * 60L * 60L;
+            final ZonedDateTime lastChecked = dbProperties.getTimestamp(DatabaseProperties.NVD_CACHE_LAST_CHECKED);
+            final ZonedDateTime now = ZonedDateTime.now(ZoneId.of("UTC"));
+            Duration duration = Duration.between(now, lastChecked);
+            long difference = duration.getSeconds();
+            proceed = difference > validForSeconds;
+            if (!proceed) {
+                LOGGER.info("Skipping NVD API Cache check since last check was within {} hours.", validForHours);
+                LOGGER.debug("Last NVD API was at {}, and now {} is within {} s.", lastChecked, now, validForSeconds);
+            }
+        }
+        return proceed;
+    }
+
+    /**
+     * Checks the CVE Index to ensure data exists and analysis can continue.
+     *
+     * @return true if the database contains data
+     */
+    private boolean dataExists() {
+        return cveDb.dataExists();
+    }
+
+    /**
+     * Determines if the index needs to be updated. This is done by fetching the
+     * NVD CVE meta data and checking the last update date. If the data needs to
+     * be refreshed this method will return the NvdCveUrl for the files that
+     * need to be updated.
+     *
+     * @param url the URL of the NVD API cache
+     * @param cacheProperties the properties from the remote NVD API cache
+     * @return the map of key to URLs - where the key is the year or `modified`
+     * @throws UpdateException Is thrown if there is an issue with the last
+     * updated properties file
+     */
+    protected final Map<String, String> getUpdatesNeeded(String url, Properties cacheProperties, ZonedDateTime now) throws UpdateException {
+        LOGGER.debug("starting getUpdatesNeeded() ...");
+        final Map<String, String> updates = new HashMap<>();
+        if (dbProperties != null && !dbProperties.isEmpty()) {
+            final int startYear = settings.getInt(Settings.KEYS.NVD_API_DATAFEED_START_YEAR, 2002);
+            // for establishing the current year use the timezone where the new year starts first
+            // as from that moment on CNAs might start assigning CVEs with the new year depending
+            // on the CNA's timezone
+            final int endYear = now.getYear();
+            boolean needsFullUpdate = false;
+            for (int y = startYear; y <= endYear; y++) {
+                final ZonedDateTime val = dbProperties.getTimestamp(DatabaseProperties.NVD_CACHE_LAST_MODIFIED + "." + y);
+                if (val == null) {
+                    needsFullUpdate = true;
+                    break;
+                }
+            }
+            final ZonedDateTime lastUpdated = dbProperties.getTimestamp(DatabaseProperties.NVD_CACHE_LAST_MODIFIED);
+            final int days = settings.getInt(Settings.KEYS.NVD_API_DATAFEED_VALID_FOR_DAYS, 7);
+
+            final String prefix = cacheProperties.getProperty("prefix", "nvdcve-");
+
+            if (!needsFullUpdate && lastUpdated.equals(DatabaseProperties.getTimestamp(cacheProperties, NVD_API_CACHE_MODIFIED_DATE))) {
+                return updates;
+            } else {
+                updates.put("modified", url + prefix + "-modified.json.gz");
+                if (needsFullUpdate) {
+                    for (int i = startYear; i < endYear; i++) {
+                        if (cacheProperties.containsKey(NVD_API_CACHE_MODIFIED_DATE + "." + i)) {
+                            updates.put(String.valueOf(i), url + prefix + "-" + i + ".json.gz");
+                        }
+                    }
+                } else if (!DateUtil.withinDateRange(lastUpdated, now, days)) {
+                    for (int i = startYear; i <= endYear; i++) {
+                        if (cacheProperties.containsKey(NVD_API_CACHE_MODIFIED_DATE + "." + i)) {
+                            final ZonedDateTime lastModifiedCache = DatabaseProperties.getTimestamp(cacheProperties, NVD_API_CACHE_MODIFIED_DATE + "." + i);
+                            final ZonedDateTime lastModifiedDB = dbProperties.getTimestamp(DatabaseProperties.NVD_CACHE_LAST_MODIFIED + "." + i);
+                            if (lastModifiedDB == null || lastModifiedCache.compareTo(lastModifiedDB) > 0) {
+                                updates.put(String.valueOf(i), url + prefix + "-" + i + ".json.gz");
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        if (updates.size() > 3) {
+            LOGGER.info("NVD API Cache requires several updates; this could take a couple of minutes.");
+        }
+        return updates;
+    }
+
+    /**
+     * Downloads the NVD CVE Meta file properties.
+     *
+     * @param url the URL to the NVD API cache
+     * @return the cache properties
+     * @throws UpdateException thrown if the properties file could not be
+     * downloaded
+     */
+    protected final Properties getRemoteCacheProperties(String url) throws UpdateException {
+        try {
+            final URL u = new URL(url + "cache.properties");
+            final Downloader d = new Downloader(settings);
+            final String content = d.fetchContent(u, true, Settings.KEYS.NVD_API_DATAFEED_USER, Settings.KEYS.NVD_API_DATAFEED_PASSWORD);
+            Properties properties = new Properties();
+            properties.load(new StringReader(content));
+            return new Properties();
+        } catch (MalformedURLException ex) {
+            throw new UpdateException("Invalid NVD Cache URL", ex);
+        } catch (DownloadFailedException | TooManyRequestsException | ResourceNotFoundException ex) {
+            throw new UpdateException("Unable to download the NVD API cache.properties", ex);
+        } catch (IOException ex) {
+            throw new UpdateException("Invalid NVD Cache Properties file contents", ex);
+        }
+    }
 }
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java b/core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java
index cbd2939b423..b6e31a9c156 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java
@@ -72,514 +72,525 @@
  * @author Jeremy Long
  */
 @ThreadSafe
+@Deprecated
 public class NvdCveUpdater implements CachedWebDataSource {
 
-    /**
-     * The logger.
-     */
-    private static final Logger LOGGER = LoggerFactory.getLogger(NvdCveUpdater.class);
-    /**
-     * The thread pool size to use for CPU-intense tasks.
-     */
-    private static final int PROCESSING_THREAD_POOL_SIZE = Runtime.getRuntime().availableProcessors();
-    /**
-     * The thread pool size to use when downloading files.
-     */
-    private static final int DOWNLOAD_THREAD_POOL_SIZE = Math.round(1.5f * Runtime.getRuntime().availableProcessors());
-    /**
-     * ExecutorService for CPU-intense processing tasks.
-     */
-    private ExecutorService processingExecutorService = null;
-    /**
-     * ExecutorService for tasks that involve blocking activities and are not
-     * very CPU-intense, e.g. downloading files.
-     */
-    private ExecutorService downloadExecutorService = null;
-    /**
-     * The configured settings.
-     */
-    private Settings settings;
-    /**
-     * Reference to the DAO.
-     */
-    private CveDB cveDb = null;
-    /**
-     * The properties obtained from the database.
-     */
-    private DatabaseProperties dbProperties = null;
-
-    /**
-     * Downloads the latest NVD CVE XML file from the web and imports it into
-     * the current CVE Database. A lock on a file is obtained in an attempt to
-     * prevent more then one thread/JVM from updating the database at the same
-     * time. This method may sleep upto 5 minutes.
-     *
-     * @param engine a reference to the dependency-check engine
-     * @return whether or not an update was made to the CveDB
-     * @throws UpdateException is thrown if there is an error updating the
-     * database
-     */
     @Override
-    public synchronized boolean update(Engine engine) throws UpdateException {
-        this.settings = engine.getSettings();
-        this.cveDb = engine.getDatabase();
-        if (isUpdateConfiguredFalse()) {
-            return false;
-        }
-        boolean updatesMade = false;
-        try {
-            dbProperties = cveDb.getDatabaseProperties();
-            if (checkUpdate()) {
-                final List<NvdCveInfo> updateable = getUpdatesNeeded();
-                if (!updateable.isEmpty()) {
-                    initializeExecutorServices();
-                    performUpdate(updateable);
-                    updatesMade = true;
-                }
-                //all dates in the db are now stored in seconds as opposed to previously milliseconds.
-                dbProperties.save(DatabaseProperties.LAST_CHECKED, Long.toString(System.currentTimeMillis() / 1000));
-                if (updatesMade) {
-                    cveDb.persistEcosystemCache();
-                }
-                final int updateCount = cveDb.updateEcosystemCache();
-                LOGGER.debug("Corrected the ecosystem for {} ecoSystemCache entries", updateCount);
-                if (updatesMade || updateCount > 0) {
-                    cveDb.cleanupDatabase();
-                }
-            }
-        } catch (UpdateException ex) {
-            if (ex.getCause() != null && ex.getCause() instanceof DownloadFailedException) {
-                final String jre = System.getProperty("java.version");
-                if (jre == null || jre.startsWith("1.4") || jre.startsWith("1.5") || jre.startsWith("1.6") || jre.startsWith("1.7")) {
-                    LOGGER.error("An old JRE is being used ({} {}), and likely does not have the correct root certificates or algorithms "
-                            + "to connect to the NVD - consider upgrading your JRE.", System.getProperty("java.vendor"), jre);
-                }
-            }
-            throw ex;
-        } catch (DatabaseException ex) {
-            throw new UpdateException("Database Exception, unable to update the data to use the most current data.", ex);
-        } finally {
-            shutdownExecutorServices();
-        }
-        return updatesMade;
-    }
-
-    /**
-     * Checks if the system is configured NOT to update.
-     *
-     * @return false if the system is configured to perform an update; otherwise
-     * true
-     */
-    private boolean isUpdateConfiguredFalse() {
-        if (!settings.getBoolean(Settings.KEYS.UPDATE_NVDCVE_ENABLED, true)) {
-            return true;
-        }
-        boolean autoUpdate = true;
-        try {
-            autoUpdate = settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
-        } catch (InvalidSettingException ex) {
-            LOGGER.debug("Invalid setting for auto-update; using true.");
-        }
-        return !autoUpdate;
-    }
-
-    /**
-     * Initialize the executor services for download and processing of the NVD
-     * CVE XML data.
-     */
-    protected void initializeExecutorServices() {
-        final int downloadPoolSize;
-        final int max = settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 1);
-        downloadPoolSize = Math.min(DOWNLOAD_THREAD_POOL_SIZE, max);
-        downloadExecutorService = Executors.newFixedThreadPool(downloadPoolSize);
-        processingExecutorService = Executors.newFixedThreadPool(PROCESSING_THREAD_POOL_SIZE);
-        LOGGER.debug("#download   threads: {}", downloadPoolSize);
-        LOGGER.debug("#processing threads: {}", PROCESSING_THREAD_POOL_SIZE);
-    }
-
-    /**
-     * Shutdown and cleanup of resources used by the executor services.
-     */
-    private void shutdownExecutorServices() {
-        if (processingExecutorService != null) {
-            processingExecutorService.shutdownNow();
-        }
-        if (downloadExecutorService != null) {
-            downloadExecutorService.shutdownNow();
-        }
-    }
-
-    /**
-     * Checks if the NVD CVE XML files were last checked recently. As an
-     * optimization, we can avoid repetitive checks against the NVD. Setting
-     * CVE_CHECK_VALID_FOR_HOURS determines the duration since last check before
-     * checking again. A database property stores the timestamp of the last
-     * check.
-     *
-     * @return true to proceed with the check, or false to skip
-     * @throws UpdateException thrown when there is an issue checking for
-     * updates
-     */
-    private boolean checkUpdate() throws UpdateException {
-        boolean proceed = true;
-        // If the valid setting has not been specified, then we proceed to check...
-        final int validForHours = settings.getInt(Settings.KEYS.CVE_CHECK_VALID_FOR_HOURS, 0);
-        if (dataExists() && 0 < validForHours) {
-            // ms Valid = valid (hours) x 60 min/hour x 60 sec/min x 1000 ms/sec
-            final long validForSeconds = validForHours * 60L * 60L;
-            final long lastChecked = getPropertyInSeconds(DatabaseProperties.LAST_CHECKED);
-            final long now = System.currentTimeMillis() / 1000;
-            proceed = (now - lastChecked) > validForSeconds;
-            if (!proceed) {
-                LOGGER.info("Skipping NVD check since last check was within {} hours.", validForHours);
-                LOGGER.debug("Last NVD was at {}, and now {} is within {} s.", lastChecked, now, validForSeconds);
-            }
-        }
-        return proceed;
-    }
-
-    /**
-     * Checks the CVE Index to ensure data exists and analysis can continue.
-     *
-     * @return true if the database contains data
-     */
-    private boolean dataExists() {
-        return cveDb.dataExists();
-    }
-
-    /**
-     * Downloads the latest NVD CVE XML file from the web and imports it into
-     * the current CVE Database.
-     *
-     * @param updateable a collection of NVD CVE data file references that need
-     * to be downloaded and processed to update the database
-     * @throws UpdateException is thrown if there is an error updating the
-     * database
-     */
-    @SuppressWarnings("FutureReturnValueIgnored")
-    private void performUpdate(List<NvdCveInfo> updateable) throws UpdateException {
-        if (updateable.isEmpty()) {
-            return;
-        }
-        if (updateable.size() > 3) {
-            LOGGER.info("NVD CVE requires several updates; this could take a couple of minutes.");
-        }
-
-        DownloadTask runLast = null;
-        final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<>(updateable.size());
-        for (NvdCveInfo cve : updateable) {
-            final DownloadTask call = new DownloadTask(cve, processingExecutorService, cveDb, settings);
-            if (call.isModified()) {
-                runLast = call;
-            } else {
-                final boolean added = downloadFutures.add(downloadExecutorService.submit(call));
-                if (!added) {
-                    throw new UpdateException("Unable to add the download task for " + cve.getId());
-                }
-            }
-        }
-
-        //next, move the future future processTasks to just future processTasks and check for errors.
-        final Set<Future<ProcessTask>> processFutures = new HashSet<>(updateable.size());
-        for (Future<Future<ProcessTask>> future : downloadFutures) {
-            final Future<ProcessTask> task;
-            try {
-                task = future.get();
-                if (task != null) {
-                    processFutures.add(task);
-                }
-            } catch (InterruptedException ex) {
-                LOGGER.debug("Thread was interrupted during download", ex);
-                Thread.currentThread().interrupt();
-                throw new UpdateException("The download was interrupted", ex);
-            } catch (ExecutionException ex) {
-                LOGGER.debug("Thread was interrupted during download execution", ex);
-                throw new UpdateException("The execution of the download was interrupted", ex);
-            }
-        }
-
-        for (Future<ProcessTask> future : processFutures) {
-            try {
-                final ProcessTask task = future.get();
-                if (task.getException() != null) {
-                    throw task.getException();
-                }
-            } catch (InterruptedException ex) {
-                LOGGER.debug("Thread was interrupted during processing", ex);
-                Thread.currentThread().interrupt();
-                throw new UpdateException(ex);
-            } catch (ExecutionException ex) {
-                LOGGER.debug("Execution Exception during process", ex);
-                throw new UpdateException(ex);
-            }
-        }
-
-        if (runLast != null) {
-            final Future<Future<ProcessTask>> modified = downloadExecutorService.submit(runLast);
-            final Future<ProcessTask> task;
-            try {
-                task = modified.get();
-                if (task != null) {
-                    final ProcessTask last = task.get();
-                    if (last.getException() != null) {
-                        throw last.getException();
-                    }
-                }
-            } catch (InterruptedException ex) {
-                LOGGER.debug("Thread was interrupted during download", ex);
-                Thread.currentThread().interrupt();
-                throw new UpdateException("The download was interrupted", ex);
-            } catch (ExecutionException ex) {
-                LOGGER.debug("Thread was interrupted during download execution", ex);
-                throw new UpdateException("The execution of the download was interrupted", ex);
-            }
-        }
-
-    }
-
-    /**
-     * Downloads the NVD CVE Meta file properties.
-     *
-     * @param url the URL to the NVD CVE JSON file
-     * @return the meta file properties
-     * @throws UpdateException thrown if the meta file could not be downloaded
-     */
-    protected final MetaProperties getMetaFile(String url) throws UpdateException {
-        try {
-            final long waitTime = settings.getInt(Settings.KEYS.CVE_DOWNLOAD_WAIT_TIME, 4000);
-            MetaProperties retVal = doMetaDownload(url, false);
-
-            final int downloadAttempts = 4;
-            for (int x = 2; retVal == null && x <= downloadAttempts; x++) {
-                Thread.sleep(waitTime * (x / 2));
-                retVal = doMetaDownload(url, x == downloadAttempts);
-            }
-            return retVal;
-        } catch (InterruptedException ex) {
-            Thread.interrupted();
-            throw new UpdateException("Download interupted", ex);
-        }
-    }
-
-    /**
-     * Downloads the NVD CVE Meta file properties.
-     *
-     * @param url the URL to the NVD CVE JSON file
-     * @param throwErrors if <code>true</code> and an error occurs, the error
-     * will be thrown; otherwise the error will be suppressed
-     * @return the meta file properties
-     * @throws UpdateException thrown if the meta file could not be downloaded
-     */
-    private MetaProperties doMetaDownload(String url, boolean throwErrors) throws UpdateException {
-        final String metaUrl = url.substring(0, url.length() - 7) + "meta";
-        final NvdCache cache = new NvdCache(settings);
-        try {
-            final URL u = new URL(metaUrl);
-            final File tmp = settings.getTempFile("nvd", "meta");
-            if (cache.notInCache(u, tmp)) {
-                final Downloader d = new Downloader(settings);
-                final String content = d.fetchContent(u, true, Settings.KEYS.CVE_USER, Settings.KEYS.CVE_PASSWORD);
-                try (FileOutputStream fos = new FileOutputStream(tmp);
-                        OutputStreamWriter osw = new OutputStreamWriter(fos, StandardCharsets.UTF_8);
-                        BufferedWriter writer = new BufferedWriter(osw)) {
-                    writer.write(content);
-                }
-                cache.storeInCache(u, tmp);
-                FileUtils.deleteQuietly(tmp);
-                return new MetaProperties(content);
-            } else {
-                final String content;
-                try (FileInputStream fis = new FileInputStream(tmp);
-                        InputStreamReader isr = new InputStreamReader(fis, StandardCharsets.UTF_8);
-                        BufferedReader reader = new BufferedReader(isr)) {
-                    content = reader.lines().collect(Collectors.joining("\n"));
-                }
-                FileUtils.deleteQuietly(tmp);
-                return new MetaProperties(content);
-            }
-        } catch (MalformedURLException ex) {
-            if (throwErrors) {
-                throw new UpdateException("Meta file url is invalid: " + metaUrl, ex);
-            }
-        } catch (InvalidDataException ex) {
-            if (throwErrors) {
-                throw new UpdateException("Meta file content is invalid: " + metaUrl, ex);
-            }
-        } catch (DownloadFailedException ex) {
-            if (throwErrors) {
-                throw new UpdateException("Unable to download meta file: " + metaUrl, ex);
-            }
-        } catch (TooManyRequestsException ex) {
-            if (throwErrors) {
-                throw new UpdateException("Unable to download meta file: " + metaUrl + "; received 429 -- too many requests", ex);
-            }
-        } catch (ResourceNotFoundException ex) {
-            if (throwErrors) {
-                throw new UpdateException("Unable to download meta file: " + metaUrl + "; received 404 -- resource not found", ex);
-            }
-        } catch (IOException ex) {
-            if (throwErrors) {
-                throw new RuntimeException(ex);
-            }
-        }
-        return null;
-    }
-
-    /**
-     * Determines if the index needs to be updated. This is done by fetching the
-     * NVD CVE meta data and checking the last update date. If the data needs to
-     * be refreshed this method will return the NvdCveUrl for the files that
-     * need to be updated.
-     *
-     * @return the collection of files that need to be updated
-     * @throws UpdateException Is thrown if there is an issue with the last
-     * updated properties file
-     */
-    protected final List<NvdCveInfo> getUpdatesNeeded() throws UpdateException {
-        LOGGER.debug("starting getUpdatesNeeded() ...");
-        final List<NvdCveInfo> updates = new ArrayList<>();
-        if (dbProperties != null && !dbProperties.isEmpty()) {
-            try {
-                final int startYear = settings.getInt(Settings.KEYS.CVE_START_YEAR, 2002);
-                // for establishing the current year use the timezone where the new year starts first
-                // as from that moment on CNAs might start assigning CVEs with the new year depending
-                // on the CNA's timezone
-                final ZonedDateTime today = ZonedDateTime.now().withZoneSameInstant(ZoneOffset.ofHours(14));
-                final int endYear = today.getYear();
-                final int dayOfEndYear = today.getDayOfYear();
-                boolean needsFullUpdate = false;
-                for (int y = startYear; y <= endYear; y++) {
-                    final long val = Long.parseLong(dbProperties.getProperty(DatabaseProperties.LAST_UPDATED_BASE + y, "0"));
-                    if (val == 0) {
-                        needsFullUpdate = true;
-                        break;
-                    }
-                }
-                final long lastUpdated = getPropertyInSeconds(DatabaseProperties.LAST_UPDATED);
-                final long now = System.currentTimeMillis() / 1000;
-                final int days = settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7);
-
-                String url = settings.getString(Settings.KEYS.CVE_MODIFIED_JSON);
-                final MetaProperties modified = getMetaFile(url);
-
-                if (!needsFullUpdate && lastUpdated == modified.getLastModifiedDate()) {
-                    return updates;
-                } else {
-                    final String baseUrl = settings.getString(Settings.KEYS.CVE_BASE_JSON);
-                    final NvdCveInfo item = new NvdCveInfo(MODIFIED, url, modified.getLastModifiedDate());
-                    updates.add(item);
-                    if (needsFullUpdate) {
-                        // no need to download each one, just use the modified timestamp
-                        for (int i = startYear; i < endYear; i++) {
-                            url = String.format(baseUrl, i);
-                            final NvdCveInfo entry = new NvdCveInfo(Integer.toString(i), url, modified.getLastModifiedDate());
-                            updates.add(entry);
-                        }
-                        // for endyear check metadata availability to determine inclusion when still in grace period
-                        if (dayOfEndYear < settings.getInt(Settings.KEYS.NVD_NEW_YEAR_GRACE_PERIOD, 10)) {
-                            try {
-                                url = String.format(baseUrl, endYear);
-                                final MetaProperties meta = getMetaFile(url);
-                            } catch (UpdateException ue) {
-                                if (ue.getCause() instanceof ResourceNotFoundException) {
-                                    LOGGER.warn("NVD Data for {} has not been published yet.", endYear);
-                                } else {
-                                    throw ue;
-                                }
-                            }
-                        } else {
-                            url = String.format(baseUrl, endYear);
-                            final NvdCveInfo entry = new NvdCveInfo(Integer.toString(endYear), url, modified.getLastModifiedDate());
-                            updates.add(entry);
-                        }
-                    } else if (!DateUtil.withinDateRange(lastUpdated, now, days)) {
-                        final long waitTime = settings.getInt(Settings.KEYS.CVE_DOWNLOAD_WAIT_TIME, 4000);
-                        for (int i = startYear; i <= endYear; i++) {
-                            try {
-                                url = String.format(baseUrl, i);
-                                Thread.sleep(waitTime);
-                                final MetaProperties meta = getMetaFile(url);
-                                final long currentTimestamp = getPropertyInSeconds(DatabaseProperties.LAST_UPDATED_BASE + i);
-
-                                if (currentTimestamp < meta.getLastModifiedDate()) {
-                                    final NvdCveInfo entry = new NvdCveInfo(Integer.toString(i), url, meta.getLastModifiedDate());
-                                    updates.add(entry);
-                                }
-                            } catch (UpdateException ex) {
-                                final int grace = settings.getInt(Settings.KEYS.NVD_NEW_YEAR_GRACE_PERIOD, 10);
-                                if (ex.getCause() instanceof ResourceNotFoundException
-                                        && i == endYear && dayOfEndYear < grace) {
-                                    LOGGER.warn("NVD Data for {} has not been published yet.", endYear);
-                                } else {
-                                    throw ex;
-                                }
-                            } catch (InterruptedException ex) {
-                                Thread.interrupted();
-                                throw new UpdateException("The download of the meta file was interupted: " + url, ex);
-                            }
-                        }
-                    }
-                }
-            } catch (NumberFormatException ex) {
-                LOGGER.warn("An invalid schema version or timestamp exists in the data.properties file.");
-                LOGGER.debug("", ex);
-            }
-        }
-        return updates;
-    }
-
-    /**
-     * Returns the database property value in seconds.
-     *
-     * @param key the key to the property
-     * @return the property value in seconds
-     */
-    private long getPropertyInSeconds(String key) {
-        final String value = dbProperties.getProperty(key, "0");
-        return DateUtil.getEpochValueInSeconds(value);
-    }
-
-    /**
-     * Sets the settings object; this is used during testing.
-     *
-     * @param settings the configured settings
-     */
-    protected synchronized void setSettings(Settings settings) {
-        this.settings = settings;
+    public boolean update(Engine engine) throws UpdateException {
+        throw new UnsupportedOperationException("Not supported yet."); // Generated from nbfs://nbhost/SystemFileSystem/Templates/Classes/Code/GeneratedMethodBody
     }
 
     @Override
     public boolean purge(Engine engine) {
-        boolean result = true;
-        try {
-            final File dataDir = engine.getSettings().getDataDirectory();
-            final File db = new File(dataDir, engine.getSettings().getString(Settings.KEYS.DB_FILE_NAME, "odc.mv.db"));
-            if (db.exists()) {
-                if (db.delete()) {
-                    LOGGER.info("Database file purged; local copy of the NVD has been removed");
-                } else {
-                    LOGGER.error("Unable to delete '{}'; please delete the file manually", db.getAbsolutePath());
-                    result = false;
-                }
-            } else {
-                LOGGER.info("Unable to purge database; the database file does not exist: {}", db.getAbsolutePath());
-                result = false;
-            }
-            final File traceFile = new File(dataDir, "odc.trace.db");
-            if (traceFile.exists() && !traceFile.delete()) {
-                LOGGER.error("Unable to delete '{}'; please delete the file manually", traceFile.getAbsolutePath());
-                result = false;
-            }
-            final File lockFile = new File(dataDir, "odc.update.lock");
-            if (lockFile.exists() && !lockFile.delete()) {
-                LOGGER.error("Unable to delete '{}'; please delete the file manually", lockFile.getAbsolutePath());
-                result = false;
-            }
-        } catch (IOException ex) {
-            final String msg = "Unable to delete the database";
-            LOGGER.error(msg, ex);
-            result = false;
-        }
-        return result;
+        throw new UnsupportedOperationException("Not supported yet."); // Generated from nbfs://nbhost/SystemFileSystem/Templates/Classes/Code/GeneratedMethodBody
     }
+
+//    /**
+//     * The logger.
+//     */
+//    private static final Logger LOGGER = LoggerFactory.getLogger(NvdCveUpdater.class);
+//    /**
+//     * The thread pool size to use for CPU-intense tasks.
+//     */
+//    private static final int PROCESSING_THREAD_POOL_SIZE = Runtime.getRuntime().availableProcessors();
+//    /**
+//     * The thread pool size to use when downloading files.
+//     */
+//    private static final int DOWNLOAD_THREAD_POOL_SIZE = Math.round(1.5f * Runtime.getRuntime().availableProcessors());
+//    /**
+//     * ExecutorService for CPU-intense processing tasks.
+//     */
+//    private ExecutorService processingExecutorService = null;
+//    /**
+//     * ExecutorService for tasks that involve blocking activities and are not
+//     * very CPU-intense, e.g. downloading files.
+//     */
+//    private ExecutorService downloadExecutorService = null;
+//    /**
+//     * The configured settings.
+//     */
+//    private Settings settings;
+//    /**
+//     * Reference to the DAO.
+//     */
+//    private CveDB cveDb = null;
+//    /**
+//     * The properties obtained from the database.
+//     */
+//    private DatabaseProperties dbProperties = null;
+//
+//    /**
+//     * Downloads the latest NVD CVE XML file from the web and imports it into
+//     * the current CVE Database. A lock on a file is obtained in an attempt to
+//     * prevent more then one thread/JVM from updating the database at the same
+//     * time. This method may sleep upto 5 minutes.
+//     *
+//     * @param engine a reference to the dependency-check engine
+//     * @return whether or not an update was made to the CveDB
+//     * @throws UpdateException is thrown if there is an error updating the
+//     * database
+//     */
+//    @Override
+//    public synchronized boolean update(Engine engine) throws UpdateException {
+//        this.settings = engine.getSettings();
+//        this.cveDb = engine.getDatabase();
+//        if (isUpdateConfiguredFalse()) {
+//            return false;
+//        }
+//        boolean updatesMade = false;
+//        try {
+//            dbProperties = cveDb.getDatabaseProperties();
+//            if (checkUpdate()) {
+//                final List<NvdCveInfo> updateable = getUpdatesNeeded();
+//                if (!updateable.isEmpty()) {
+//                    initializeExecutorServices();
+//                    performUpdate(updateable);
+//                    updatesMade = true;
+//                }
+//                //all dates in the db are now stored in seconds as opposed to previously milliseconds.
+//                dbProperties.save(DatabaseProperties.LAST_CHECKED, Long.toString(System.currentTimeMillis() / 1000));
+//                if (updatesMade) {
+//                    cveDb.persistEcosystemCache();
+//                }
+//                final int updateCount = cveDb.updateEcosystemCache();
+//                LOGGER.debug("Corrected the ecosystem for {} ecoSystemCache entries", updateCount);
+//                if (updatesMade || updateCount > 0) {
+//                    cveDb.cleanupDatabase();
+//                }
+//            }
+//        } catch (UpdateException ex) {
+//            if (ex.getCause() != null && ex.getCause() instanceof DownloadFailedException) {
+//                final String jre = System.getProperty("java.version");
+//                if (jre == null || jre.startsWith("1.4") || jre.startsWith("1.5") || jre.startsWith("1.6") || jre.startsWith("1.7")) {
+//                    LOGGER.error("An old JRE is being used ({} {}), and likely does not have the correct root certificates or algorithms "
+//                            + "to connect to the NVD - consider upgrading your JRE.", System.getProperty("java.vendor"), jre);
+//                }
+//            }
+//            throw ex;
+//        } catch (DatabaseException ex) {
+//            throw new UpdateException("Database Exception, unable to update the data to use the most current data.", ex);
+//        } finally {
+//            shutdownExecutorServices();
+//        }
+//        return updatesMade;
+//    }
+//
+//    /**
+//     * Checks if the system is configured NOT to update.
+//     *
+//     * @return false if the system is configured to perform an update; otherwise
+//     * true
+//     */
+//    private boolean isUpdateConfiguredFalse() {
+//        if (!settings.getBoolean(Settings.KEYS.UPDATE_NVDCVE_ENABLED, true)) {
+//            return true;
+//        }
+//        boolean autoUpdate = true;
+//        try {
+//            autoUpdate = settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
+//        } catch (InvalidSettingException ex) {
+//            LOGGER.debug("Invalid setting for auto-update; using true.");
+//        }
+//        return !autoUpdate;
+//    }
+//
+//    /**
+//     * Initialize the executor services for download and processing of the NVD
+//     * CVE XML data.
+//     */
+//    protected void initializeExecutorServices() {
+//        final int downloadPoolSize;
+//        final int max = settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 1);
+//        downloadPoolSize = Math.min(DOWNLOAD_THREAD_POOL_SIZE, max);
+//        downloadExecutorService = Executors.newFixedThreadPool(downloadPoolSize);
+//        processingExecutorService = Executors.newFixedThreadPool(PROCESSING_THREAD_POOL_SIZE);
+//        LOGGER.debug("#download   threads: {}", downloadPoolSize);
+//        LOGGER.debug("#processing threads: {}", PROCESSING_THREAD_POOL_SIZE);
+//    }
+//
+//    /**
+//     * Shutdown and cleanup of resources used by the executor services.
+//     */
+//    private void shutdownExecutorServices() {
+//        if (processingExecutorService != null) {
+//            processingExecutorService.shutdownNow();
+//        }
+//        if (downloadExecutorService != null) {
+//            downloadExecutorService.shutdownNow();
+//        }
+//    }
+//
+//    /**
+//     * Checks if the NVD CVE XML files were last checked recently. As an
+//     * optimization, we can avoid repetitive checks against the NVD. Setting
+//     * CVE_CHECK_VALID_FOR_HOURS determines the duration since last check before
+//     * checking again. A database property stores the timestamp of the last
+//     * check.
+//     *
+//     * @return true to proceed with the check, or false to skip
+//     * @throws UpdateException thrown when there is an issue checking for
+//     * updates
+//     */
+//    private boolean checkUpdate() throws UpdateException {
+//        boolean proceed = true;
+//        // If the valid setting has not been specified, then we proceed to check...
+//        final int validForHours = settings.getInt(Settings.KEYS.CVE_CHECK_VALID_FOR_HOURS, 0);
+//        if (dataExists() && 0 < validForHours) {
+//            // ms Valid = valid (hours) x 60 min/hour x 60 sec/min x 1000 ms/sec
+//            final long validForSeconds = validForHours * 60L * 60L;
+//            final long lastChecked = getPropertyInSeconds(DatabaseProperties.LAST_CHECKED);
+//            final long now = System.currentTimeMillis() / 1000;
+//            proceed = (now - lastChecked) > validForSeconds;
+//            if (!proceed) {
+//                LOGGER.info("Skipping NVD check since last check was within {} hours.", validForHours);
+//                LOGGER.debug("Last NVD was at {}, and now {} is within {} s.", lastChecked, now, validForSeconds);
+//            }
+//        }
+//        return proceed;
+//    }
+//
+//    /**
+//     * Checks the CVE Index to ensure data exists and analysis can continue.
+//     *
+//     * @return true if the database contains data
+//     */
+//    private boolean dataExists() {
+//        return cveDb.dataExists();
+//    }
+//
+//    /**
+//     * Downloads the latest NVD CVE XML file from the web and imports it into
+//     * the current CVE Database.
+//     *
+//     * @param updateable a collection of NVD CVE data file references that need
+//     * to be downloaded and processed to update the database
+//     * @throws UpdateException is thrown if there is an error updating the
+//     * database
+//     */
+//    @SuppressWarnings("FutureReturnValueIgnored")
+//    private void performUpdate(List<NvdCveInfo> updateable) throws UpdateException {
+//        if (updateable.isEmpty()) {
+//            return;
+//        }
+//        if (updateable.size() > 3) {
+//            LOGGER.info("NVD CVE requires several updates; this could take a couple of minutes.");
+//        }
+//
+//        DownloadTask runLast = null;
+//        final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<>(updateable.size());
+//        for (NvdCveInfo cve : updateable) {
+//            final DownloadTask call = new DownloadTask(cve, processingExecutorService, cveDb, settings);
+//            if (call.isModified()) {
+//                runLast = call;
+//            } else {
+//                final boolean added = downloadFutures.add(downloadExecutorService.submit(call));
+//                if (!added) {
+//                    throw new UpdateException("Unable to add the download task for " + cve.getId());
+//                }
+//            }
+//        }
+//
+//        //next, move the future future processTasks to just future processTasks and check for errors.
+//        final Set<Future<ProcessTask>> processFutures = new HashSet<>(updateable.size());
+//        for (Future<Future<ProcessTask>> future : downloadFutures) {
+//            final Future<ProcessTask> task;
+//            try {
+//                task = future.get();
+//                if (task != null) {
+//                    processFutures.add(task);
+//                }
+//            } catch (InterruptedException ex) {
+//                LOGGER.debug("Thread was interrupted during download", ex);
+//                Thread.currentThread().interrupt();
+//                throw new UpdateException("The download was interrupted", ex);
+//            } catch (ExecutionException ex) {
+//                LOGGER.debug("Thread was interrupted during download execution", ex);
+//                throw new UpdateException("The execution of the download was interrupted", ex);
+//            }
+//        }
+//
+//        for (Future<ProcessTask> future : processFutures) {
+//            try {
+//                final ProcessTask task = future.get();
+//                if (task.getException() != null) {
+//                    throw task.getException();
+//                }
+//            } catch (InterruptedException ex) {
+//                LOGGER.debug("Thread was interrupted during processing", ex);
+//                Thread.currentThread().interrupt();
+//                throw new UpdateException(ex);
+//            } catch (ExecutionException ex) {
+//                LOGGER.debug("Execution Exception during process", ex);
+//                throw new UpdateException(ex);
+//            }
+//        }
+//
+////        if (runLast != null) {
+////            final Future<Future<ProcessTask>> modified = downloadExecutorService.submit(runLast);
+////            final Future<ProcessTask> task;
+////            try {
+////                task = modified.get();
+////                if (task != null) {
+////                    final ProcessTask last = task.get();
+////                    if (last.getException() != null) {
+////                        throw last.getException();
+////                    }
+////                }
+////            } catch (InterruptedException ex) {
+////                LOGGER.debug("Thread was interrupted during download", ex);
+////                Thread.currentThread().interrupt();
+////                throw new UpdateException("The download was interrupted", ex);
+////            } catch (ExecutionException ex) {
+////                LOGGER.debug("Thread was interrupted during download execution", ex);
+////                throw new UpdateException("The execution of the download was interrupted", ex);
+////            }
+////        }
+//
+//    }
+//
+//    /**
+//     * Downloads the NVD CVE Meta file properties.
+//     *
+//     * @param url the URL to the NVD CVE JSON file
+//     * @return the meta file properties
+//     * @throws UpdateException thrown if the meta file could not be downloaded
+//     */
+//    protected final MetaProperties getMetaFile(String url) throws UpdateException {
+//        try {
+//            final long waitTime = settings.getInt(Settings.KEYS.CVE_DOWNLOAD_WAIT_TIME, 4000);
+//            MetaProperties retVal = doMetaDownload(url, false);
+//
+//            final int downloadAttempts = 4;
+//            for (int x = 2; retVal == null && x <= downloadAttempts; x++) {
+//                Thread.sleep(waitTime * (x / 2));
+//                retVal = doMetaDownload(url, x == downloadAttempts);
+//            }
+//            return retVal;
+//        } catch (InterruptedException ex) {
+//            Thread.interrupted();
+//            throw new UpdateException("Download interupted", ex);
+//        }
+//    }
+//
+//    /**
+//     * Downloads the NVD CVE Meta file properties.
+//     *
+//     * @param url the URL to the NVD CVE JSON file
+//     * @param throwErrors if <code>true</code> and an error occurs, the error
+//     * will be thrown; otherwise the error will be suppressed
+//     * @return the meta file properties
+//     * @throws UpdateException thrown if the meta file could not be downloaded
+//     */
+//    private MetaProperties doMetaDownload(String url, boolean throwErrors) throws UpdateException {
+//        final String metaUrl = url.substring(0, url.length() - 7) + "meta";
+//        final NvdCache cache = new NvdCache(settings);
+//        try {
+//            final URL u = new URL(metaUrl);
+//            final File tmp = settings.getTempFile("nvd", "meta");
+//            if (cache.notInCache(u, tmp)) {
+//                final Downloader d = new Downloader(settings);
+//                final String content = d.fetchContent(u, true, Settings.KEYS.CVE_USER, Settings.KEYS.CVE_PASSWORD);
+//                try (FileOutputStream fos = new FileOutputStream(tmp);
+//                        OutputStreamWriter osw = new OutputStreamWriter(fos, StandardCharsets.UTF_8);
+//                        BufferedWriter writer = new BufferedWriter(osw)) {
+//                    writer.write(content);
+//                }
+//                cache.storeInCache(u, tmp);
+//                FileUtils.deleteQuietly(tmp);
+//                return new MetaProperties(content);
+//            } else {
+//                final String content;
+//                try (FileInputStream fis = new FileInputStream(tmp);
+//                        InputStreamReader isr = new InputStreamReader(fis, StandardCharsets.UTF_8);
+//                        BufferedReader reader = new BufferedReader(isr)) {
+//                    content = reader.lines().collect(Collectors.joining("\n"));
+//                }
+//                FileUtils.deleteQuietly(tmp);
+//                return new MetaProperties(content);
+//            }
+//        } catch (MalformedURLException ex) {
+//            if (throwErrors) {
+//                throw new UpdateException("Meta file url is invalid: " + metaUrl, ex);
+//            }
+//        } catch (InvalidDataException ex) {
+//            if (throwErrors) {
+//                throw new UpdateException("Meta file content is invalid: " + metaUrl, ex);
+//            }
+//        } catch (DownloadFailedException ex) {
+//            if (throwErrors) {
+//                throw new UpdateException("Unable to download meta file: " + metaUrl, ex);
+//            }
+//        } catch (TooManyRequestsException ex) {
+//            if (throwErrors) {
+//                throw new UpdateException("Unable to download meta file: " + metaUrl + "; received 429 -- too many requests", ex);
+//            }
+//        } catch (ResourceNotFoundException ex) {
+//            if (throwErrors) {
+//                throw new UpdateException("Unable to download meta file: " + metaUrl + "; received 404 -- resource not found", ex);
+//            }
+//        } catch (IOException ex) {
+//            if (throwErrors) {
+//                throw new RuntimeException(ex);
+//            }
+//        }
+//        return null;
+//    }
+//
+//    /**
+//     * Determines if the index needs to be updated. This is done by fetching the
+//     * NVD CVE meta data and checking the last update date. If the data needs to
+//     * be refreshed this method will return the NvdCveUrl for the files that
+//     * need to be updated.
+//     *
+//     * @return the collection of files that need to be updated
+//     * @throws UpdateException Is thrown if there is an issue with the last
+//     * updated properties file
+//     */
+//    protected final List<NvdCveInfo> getUpdatesNeeded() throws UpdateException {
+//        LOGGER.debug("starting getUpdatesNeeded() ...");
+//        final List<NvdCveInfo> updates = new ArrayList<>();
+//        if (dbProperties != null && !dbProperties.isEmpty()) {
+//            try {
+//                final int startYear = settings.getInt(Settings.KEYS.CVE_START_YEAR, 2002);
+//                // for establishing the current year use the timezone where the new year starts first
+//                // as from that moment on CNAs might start assigning CVEs with the new year depending
+//                // on the CNA's timezone
+//                final ZonedDateTime today = ZonedDateTime.now().withZoneSameInstant(ZoneOffset.ofHours(14));
+//                final int endYear = today.getYear();
+//                final int dayOfEndYear = today.getDayOfYear();
+//                boolean needsFullUpdate = false;
+//                for (int y = startYear; y <= endYear; y++) {
+//                    final long val = Long.parseLong(dbProperties.getProperty(DatabaseProperties.LAST_UPDATED_BASE + y, "0"));
+//                    if (val == 0) {
+//                        needsFullUpdate = true;
+//                        break;
+//                    }
+//                }
+//                final long lastUpdated = getPropertyInSeconds(DatabaseProperties.LAST_UPDATED);
+//                final long now = System.currentTimeMillis() / 1000;
+//                final int days = settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7);
+//
+//                String url = settings.getString(Settings.KEYS.CVE_MODIFIED_JSON);
+//                final MetaProperties modified = getMetaFile(url);
+//
+//                if (!needsFullUpdate && lastUpdated == modified.getLastModifiedDate()) {
+//                    return updates;
+//                } else {
+//                    final String baseUrl = settings.getString(Settings.KEYS.CVE_BASE_JSON);
+//                    final NvdCveInfo item = new NvdCveInfo(MODIFIED, url, modified.getLastModifiedDate());
+//                    updates.add(item);
+//                    if (needsFullUpdate) {
+//                        // no need to download each one, just use the modified timestamp
+//                        for (int i = startYear; i < endYear; i++) {
+//                            url = String.format(baseUrl, i);
+//                            final NvdCveInfo entry = new NvdCveInfo(Integer.toString(i), url, modified.getLastModifiedDate());
+//                            updates.add(entry);
+//                        }
+//                        // for endyear check metadata availability to determine inclusion when still in grace period
+//                        if (dayOfEndYear < settings.getInt(Settings.KEYS.NVD_NEW_YEAR_GRACE_PERIOD, 10)) {
+//                            try {
+//                                url = String.format(baseUrl, endYear);
+//                                final MetaProperties meta = getMetaFile(url);
+//                            } catch (UpdateException ue) {
+//                                if (ue.getCause() instanceof ResourceNotFoundException) {
+//                                    LOGGER.warn("NVD Data for {} has not been published yet.", endYear);
+//                                } else {
+//                                    throw ue;
+//                                }
+//                            }
+//                        } else {
+//                            url = String.format(baseUrl, endYear);
+//                            final NvdCveInfo entry = new NvdCveInfo(Integer.toString(endYear), url, modified.getLastModifiedDate());
+//                            updates.add(entry);
+//                        }
+//                    } else if (!DateUtil.withinDateRange(lastUpdated, now, days)) {
+//                        final long waitTime = settings.getInt(Settings.KEYS.CVE_DOWNLOAD_WAIT_TIME, 4000);
+//                        for (int i = startYear; i <= endYear; i++) {
+//                            try {
+//                                url = String.format(baseUrl, i);
+//                                Thread.sleep(waitTime);
+//                                final MetaProperties meta = getMetaFile(url);
+//                                final long currentTimestamp = getPropertyInSeconds(DatabaseProperties.LAST_UPDATED_BASE + i);
+//
+//                                if (currentTimestamp < meta.getLastModifiedDate()) {
+//                                    final NvdCveInfo entry = new NvdCveInfo(Integer.toString(i), url, meta.getLastModifiedDate());
+//                                    updates.add(entry);
+//                                }
+//                            } catch (UpdateException ex) {
+//                                final int grace = settings.getInt(Settings.KEYS.NVD_NEW_YEAR_GRACE_PERIOD, 10);
+//                                if (ex.getCause() instanceof ResourceNotFoundException
+//                                        && i == endYear && dayOfEndYear < grace) {
+//                                    LOGGER.warn("NVD Data for {} has not been published yet.", endYear);
+//                                } else {
+//                                    throw ex;
+//                                }
+//                            } catch (InterruptedException ex) {
+//                                Thread.interrupted();
+//                                throw new UpdateException("The download of the meta file was interupted: " + url, ex);
+//                            }
+//                        }
+//                    }
+//                }
+//            } catch (NumberFormatException ex) {
+//                LOGGER.warn("An invalid schema version or timestamp exists in the data.properties file.");
+//                LOGGER.debug("", ex);
+//            }
+//        }
+//        return updates;
+//    }
+//
+//    /**
+//     * Returns the database property value in seconds.
+//     *
+//     * @param key the key to the property
+//     * @return the property value in seconds
+//     */
+//    private long getPropertyInSeconds(String key) {
+//        final String value = dbProperties.getProperty(key, "0");
+//        return DateUtil.getEpochValueInSeconds(value);
+//    }
+//
+//    /**
+//     * Sets the settings object; this is used during testing.
+//     *
+//     * @param settings the configured settings
+//     */
+//    protected synchronized void setSettings(Settings settings) {
+//        this.settings = settings;
+//    }
+//
+//    @Override
+//    public boolean purge(Engine engine) {
+//        boolean result = true;
+//        try {
+//            final File dataDir = engine.getSettings().getDataDirectory();
+//            final File db = new File(dataDir, engine.getSettings().getString(Settings.KEYS.DB_FILE_NAME, "odc.mv.db"));
+//            if (db.exists()) {
+//                if (db.delete()) {
+//                    LOGGER.info("Database file purged; local copy of the NVD has been removed");
+//                } else {
+//                    LOGGER.error("Unable to delete '{}'; please delete the file manually", db.getAbsolutePath());
+//                    result = false;
+//                }
+//            } else {
+//                LOGGER.info("Unable to purge database; the database file does not exist: {}", db.getAbsolutePath());
+//                result = false;
+//            }
+//            final File traceFile = new File(dataDir, "odc.trace.db");
+//            if (traceFile.exists() && !traceFile.delete()) {
+//                LOGGER.error("Unable to delete '{}'; please delete the file manually", traceFile.getAbsolutePath());
+//                result = false;
+//            }
+//            final File lockFile = new File(dataDir, "odc.update.lock");
+//            if (lockFile.exists() && !lockFile.delete()) {
+//                LOGGER.error("Unable to delete '{}'; please delete the file manually", lockFile.getAbsolutePath());
+//                result = false;
+//            }
+//        } catch (IOException ex) {
+//            final String msg = "Unable to delete the database";
+//            LOGGER.error(msg, ex);
+//            result = false;
+//        }
+//        return result;
+//    }
 }
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java
index a0d8f0bf9ce..545750561a9 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java
@@ -17,9 +17,9 @@
  */
 package org.owasp.dependencycheck.data.update.nvd;
 
-import java.io.File;
-import java.io.IOException;
-import java.net.MalformedURLException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
+import io.github.jeremylong.openvulnerability.client.nvd.CveApiJson20;
 import java.net.URL;
 import java.util.concurrent.Callable;
 import java.util.concurrent.ExecutorService;
@@ -28,21 +28,19 @@
 import org.apache.commons.lang3.StringUtils;
 import org.owasp.dependencycheck.data.nvdcve.CveDB;
 import org.owasp.dependencycheck.data.update.exception.UpdateException;
-import org.owasp.dependencycheck.utils.DownloadFailedException;
+import org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor;
 import org.owasp.dependencycheck.utils.Downloader;
-import org.owasp.dependencycheck.utils.ResourceNotFoundException;
 import org.owasp.dependencycheck.utils.Settings;
-import org.owasp.dependencycheck.utils.TooManyRequestsException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
- * A callable object to download two files.
+ * A callable object to download the NVD API cache files and start the NvdApiProcessor.
  *
  * @author Jeremy Long
  */
 @ThreadSafe
-public class DownloadTask implements Callable<Future<ProcessTask>> {
+public class DownloadTask implements Callable<Future<NvdApiProcessor>> {
 
     /**
      * The Logger.
@@ -57,22 +55,18 @@ public class DownloadTask implements Callable<Future<ProcessTask>> {
      */
     private final ExecutorService processorService;
     /**
-     * The NVD CVE Meta Data.
+     * The NVD API Cache file URL.
      */
-    private NvdCveInfo nvdCveInfo;
+    private final String url;
     /**
      * A reference to the global settings object.
      */
     private final Settings settings;
-    /**
-     * a file.
-     */
-    private final File file;
 
     /**
      * Simple constructor for the callable download task.
      *
-     * @param nvdCveInfo the NVD CVE info
+     * @param url the file to download
      * @param processor the processor service to submit the downloaded files to
      * @param cveDB the CVE DB to use to store the vulnerability data
      * @param settings a reference to the global settings object; this is
@@ -80,135 +74,49 @@ public class DownloadTask implements Callable<Future<ProcessTask>> {
      * correct reference to the global settings.
      * @throws UpdateException thrown if temporary files could not be created
      */
-    public DownloadTask(NvdCveInfo nvdCveInfo, ExecutorService processor, CveDB cveDB, Settings settings) throws UpdateException {
-        this.nvdCveInfo = nvdCveInfo;
+    public DownloadTask(String url, ExecutorService processor, CveDB cveDB, Settings settings) throws UpdateException {
+        this.url = url;
         this.processorService = processor;
         this.cveDB = cveDB;
         this.settings = settings;
-
-        try {
-            this.file = File.createTempFile("cve" + nvdCveInfo.getId() + '_', ".json.gz", settings.getTempDirectory());
-        } catch (IOException ex) {
-            throw new UpdateException("Unable to create temporary files", ex);
-        }
-    }
-
-    /**
-     * Get the value of nvdCveInfo.
-     *
-     * @return the value of nvdCveInfo
-     */
-    public NvdCveInfo getNvdCveInfo() {
-        return nvdCveInfo;
-    }
-
-    /**
-     * Set the value of nvdCveInfo.
-     *
-     * @param nvdCveInfo new value of nvdCveInfo
-     */
-    public void setNvdCveInfo(NvdCveInfo nvdCveInfo) {
-        this.nvdCveInfo = nvdCveInfo;
-    }
-
-    /**
-     * Get the value of file.
-     *
-     * @return the value of file
-     */
-    public File getFile() {
-        return file;
     }
 
     @SuppressWarnings("BusyWait")
     @Override
-    public Future<ProcessTask> call() throws Exception {
-        final long waitTime = settings.getInt(Settings.KEYS.CVE_DOWNLOAD_WAIT_TIME, 4000);
-        long startDownload = 0;
-        final NvdCache cache = new NvdCache(settings);
+    public Future<NvdApiProcessor> call() throws Exception {
         try {
-            final URL url1 = new URL(nvdCveInfo.getUrl());
-            if (cache.notInCache(url1, file)) {
-                Thread.sleep(waitTime);
-                LOGGER.info("Download Started for NVD CVE - {}", nvdCveInfo.getId());
-                startDownload = System.currentTimeMillis();
-                final int downloadAttempts = 5;
-                for (int x = 2; x <= downloadAttempts && !attemptDownload(url1, x == downloadAttempts); x++) {
-                    LOGGER.info("Download Attempt {} for NVD CVE - {}", x, nvdCveInfo.getId());
-                    Thread.sleep(waitTime * (x / 2));
-                }
-                if (file.isFile() && file.length() > 0) {
-                    LOGGER.info("Download Complete for NVD CVE - {}  ({} ms)", nvdCveInfo.getId(),
-                            System.currentTimeMillis() - startDownload);
-                    cache.storeInCache(url1, file);
-                } else {
-                    throw new DownloadFailedException("Unable to download NVD CVE " + nvdCveInfo.getId());
-                }
-            }
+            final URL u = new URL(url);
+            LOGGER.info("Download Started for NVD Cache - {}", url);
+            long startDownload = System.currentTimeMillis();
+            final Downloader d = new Downloader(settings);
+            final String content = d.fetchContent(u, true, Settings.KEYS.NVD_API_DATAFEED_USER, Settings.KEYS.NVD_API_DATAFEED_PASSWORD);
+            final ObjectMapper objectMapper = new ObjectMapper();
+            objectMapper.registerModule(new JavaTimeModule());
+            CveApiJson20 data = objectMapper.readValue(content, CveApiJson20.class);
+            
             if (this.processorService == null) {
                 return null;
             }
-            final ProcessTask task = new ProcessTask(cveDB, this, settings);
-            final Future<ProcessTask> val = this.processorService.submit(task);
+            final NvdApiProcessor task = new NvdApiProcessor(cveDB, data.getVulnerabilities(), startDownload);
+            final Future<NvdApiProcessor> val = this.processorService.submit(task);
             return val;
-
         } catch (Throwable ex) {
-            LOGGER.error("Error downloading NVD CVE - {} Reason: {}", nvdCveInfo.getId(), ex.getMessage());
+            LOGGER.error("Error downloading NVD CVE - {} Reason: {}", url, ex.getMessage());
             throw ex;
         } finally {
             settings.cleanup(false);
         }
     }
 
-    private boolean attemptDownload(final URL url1, boolean showLog) throws TooManyRequestsException, ResourceNotFoundException {
-        try {
-            final Downloader downloader = new Downloader(settings);
-            downloader.fetchFile(url1, file, Settings.KEYS.CVE_USER, Settings.KEYS.CVE_PASSWORD);
-        } catch (DownloadFailedException ex) {
-            if (showLog) {
-                LOGGER.error("Download Failed for NVD CVE - {}\nSome CVEs may not be reported. Reason: {}",
-                        nvdCveInfo.getId(), ex.getMessage());
-                if (settings.getString(Settings.KEYS.PROXY_SERVER) == null) {
-                    LOGGER.error("If you are behind a proxy you may need to configure dependency-check to use the proxy.");
-                }
-                LOGGER.debug("", ex);
-            }
-            return false;
-        }
-        return true;
-    }
-
-    /**
-     * Attempts to delete the files that were downloaded.
-     */
-    public void cleanup() {
-        if (file != null && file.exists() && !file.delete()) {
-            LOGGER.debug("Failed to delete first temporary file {}", file);
-            file.deleteOnExit();
-        }
-    }
-
-    /**
-     * Attempts to delete the files that were downloaded.
-     */
-    public void evictCorruptFileFromCache() {
-        final NvdCache cache = new NvdCache(settings);
-        try {
-            final URL url1 = new URL(nvdCveInfo.getUrl());
-            cache.evictFromCache(url1);
-        } catch (MalformedURLException e) {
-            LOGGER.debug("Ignoring Cache-eviction request for an invalid URL");
-        }
-    }
 
     /**
      * Returns true if the process task is for the modified json file from the
-     * NVD.
+     * NVD API Cache.
      *
      * @return <code>true</code> if the process task is for the modified data;
      * otherwise <code>false</code>
      */
     public boolean isModified() {
-        return StringUtils.containsIgnoreCase(file.toString(), "modified");
+        return StringUtils.containsIgnoreCase(url, "modified");
     }
 }
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfo.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfo.java
index 57009240d7a..7b9e7666d46 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfo.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfo.java
@@ -17,6 +17,7 @@
  */
 package org.owasp.dependencycheck.data.update.nvd;
 
+import java.time.ZonedDateTime;
 import javax.annotation.concurrent.ThreadSafe;
 
 /**
@@ -25,6 +26,7 @@
  * @author Jeremy Long
  */
 @ThreadSafe
+@Deprecated
 public class NvdCveInfo {
 
     /**
@@ -38,7 +40,7 @@ public class NvdCveInfo {
     /**
      * The timestamp of the file - epoch time.
      */
-    private final long timestamp;
+    private final ZonedDateTime timestamp;
 
     /**
      * Construct a new NVD CVE Info object.
@@ -47,7 +49,7 @@ public class NvdCveInfo {
      * @param url the url
      * @param timestamp the timestamp
      */
-    public NvdCveInfo(String id, String url, long timestamp) {
+    public NvdCveInfo(String id, String url, ZonedDateTime timestamp) {
         this.id = id;
         this.url = url;
         this.timestamp = timestamp;
@@ -76,7 +78,7 @@ public String getUrl() {
      *
      * @return the value of timestamp - epoch time
      */
-    public long getTimestamp() {
+    public ZonedDateTime getTimestamp() {
         return timestamp;
     }
 }
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/ProcessTask.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/ProcessTask.java
index 31b77c09f51..d0f7e9cc5c8 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/ProcessTask.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/ProcessTask.java
@@ -39,6 +39,7 @@
  * @author Jeremy Long
  */
 @ThreadSafe
+@Deprecated
 public class ProcessTask implements Callable<ProcessTask> {
 
     /**
@@ -148,20 +149,20 @@ protected void importJSON(File file) throws ParserConfigurationException, IOExce
      * the database
      */
     private void processFiles() throws UpdateException {
-        LOGGER.info("Processing Started for NVD CVE - {}", downloadTask.getNvdCveInfo().getId());
-        final long startProcessing = System.currentTimeMillis();
-        try {
-            importJSON(downloadTask.getFile());
-            properties.save(downloadTask.getNvdCveInfo());
-        } catch (ParserConfigurationException | SQLException | DatabaseException | ClassNotFoundException | IOException ex) {
-            throw new UpdateException(ex);
-        } catch (CorruptedDatastreamException ex) {
-            downloadTask.evictCorruptFileFromCache();
-            throw new UpdateException(ex);
-        } finally {
-            downloadTask.cleanup();
-        }
-        LOGGER.info("Processing Complete for NVD CVE - {}  ({} ms)", downloadTask.getNvdCveInfo().getId(),
-                System.currentTimeMillis() - startProcessing);
+//        LOGGER.info("Processing Started for NVD CVE - {}", downloadTask.getNvdCveInfo().getId());
+//        final long startProcessing = System.currentTimeMillis();
+//        try {
+//            importJSON(downloadTask.getFile());
+//            properties.save(downloadTask.getNvdCveInfo());
+//        } catch (ParserConfigurationException | SQLException | DatabaseException | ClassNotFoundException | IOException ex) {
+//            throw new UpdateException(ex);
+//        } catch (CorruptedDatastreamException ex) {
+//            downloadTask.evictCorruptFileFromCache();
+//            throw new UpdateException(ex);
+//        } finally {
+//            downloadTask.cleanup();
+//        }
+//        LOGGER.info("Processing Complete for NVD CVE - {}  ({} ms)", downloadTask.getNvdCveInfo().getId(),
+//                System.currentTimeMillis() - startProcessing);
     }
 }
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/NvdApiProcessor.java b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/NvdApiProcessor.java
index 46306de8cc1..72980eb29fd 100644
--- a/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/NvdApiProcessor.java
+++ b/core/src/main/java/org/owasp/dependencycheck/data/update/nvd/api/NvdApiProcessor.java
@@ -33,10 +33,17 @@ public class NvdApiProcessor implements Callable<NvdApiProcessor> {
     private final CveDB cveDB;
     private final Collection<DefCveItem> data;
     private final CveEcosystemMapper mapper = new CveEcosystemMapper();
-
-    public NvdApiProcessor(final CveDB cveDB, Collection<DefCveItem> data) {
+    private final long startTime;
+    private long endTime = 0;
+    
+    public NvdApiProcessor(final CveDB cveDB, Collection<DefCveItem> data, long startTime) {
         this.cveDB = cveDB;
         this.data = data;
+        this.startTime = startTime;
+    }
+
+    public NvdApiProcessor(final CveDB cveDB, Collection<DefCveItem> data) {
+        this(cveDB, data, System.currentTimeMillis());
     }
 
     @Override
@@ -44,7 +51,11 @@ public NvdApiProcessor call() throws Exception {
         for (DefCveItem entry : data) {
             cveDB.updateVulnerability(entry, mapper.getEcosystem(entry));
         }
+        endTime = System.currentTimeMillis();
         return this;
     }
-
+    
+    public long getDurationMillis() {
+        return endTime - startTime;
+    }
 }
diff --git a/core/src/main/java/org/owasp/dependencycheck/utils/DateUtil.java b/core/src/main/java/org/owasp/dependencycheck/utils/DateUtil.java
index b385892fa2c..689ce2e9e66 100644
--- a/core/src/main/java/org/owasp/dependencycheck/utils/DateUtil.java
+++ b/core/src/main/java/org/owasp/dependencycheck/utils/DateUtil.java
@@ -17,6 +17,8 @@
  */
 package org.owasp.dependencycheck.utils;
 
+import java.time.Duration;
+import java.time.ZonedDateTime;
 import org.owasp.dependencycheck.exception.ParseException;
 
 import java.util.Calendar;
@@ -80,6 +82,22 @@ public static boolean withinDateRange(long date, long compareTo, int dayRange) {
         return (compareTo - date) < msRange;
     }
 
+    /**
+     * Determines if the date is within the given day range.
+     *
+     * @param date the date
+     * @param compareTo the date to compare against
+     * @param dayRange the number of days allowed
+     * @return if the date is within the dayRange of compareTo
+     */
+    public static boolean withinDateRange(ZonedDateTime date, ZonedDateTime compareTo, int dayRange) {
+        //seconds = dayRange x 24 hours/day x 60 min/hour x 60 sec/min
+        final long seconds = dayRange * 24L * 60L * 60L;
+        Duration duration = Duration.between(date, compareTo);
+        long secondsDifference = duration.getSeconds();
+        return secondsDifference < seconds;
+    }
+
     /**
      * Returns the string value converted to an epoch seconds. Note, in some
      * cases the value provided may be in milliseconds.
diff --git a/core/src/main/resources/dependencycheck.properties b/core/src/main/resources/dependencycheck.properties
index 64fbdbebddc..16ccd06b515 100644
--- a/core/src/main/resources/dependencycheck.properties
+++ b/core/src/main/resources/dependencycheck.properties
@@ -51,6 +51,13 @@ data.driver_name=org.h2.Driver
 data.writelock.shutdownhook=org.owasp.dependencycheck.utils.WriteLockCleanupHook
 
 proxy.disableSchemas=true
+
+nvd.api.check.validforhours=4
+nvd.api.datafeed.validfordays=7
+#nvd.api.datafeed.url=https://example.com/nvd-cache/
+#nvd.api.datafeed.user=
+#nvd.api.datafeed.password=
+
 # the number of days that the modified nvd cve data holds data for. We don't need
 # to update the other files if we are within this timespan. Per NIST this file
 # holds 8 days of updates, we are using 7 just to be safe.
diff --git a/core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesIT.java b/core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesIT.java
index b25d8647bce..9e5a2e511ce 100644
--- a/core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesIT.java
+++ b/core/src/test/java/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesIT.java
@@ -21,7 +21,6 @@
 import java.util.Properties;
 import org.junit.After;
 import org.junit.Test;
-import org.owasp.dependencycheck.data.update.nvd.NvdCveInfo;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
@@ -61,21 +60,6 @@ public void testIsEmpty() throws Exception {
         //assertEquals(expResult, result);
     }
 
-    /**
-     * Test of save method, of class DatabaseProperties.
-     */
-    @Test
-    public void testSave() throws Exception {
-        NvdCveInfo updatedValue = new NvdCveInfo("test","url",1337L);
-        String key = "test";
-        long expected = 1337L;
-        DatabaseProperties instance = cveDb.getDatabaseProperties();
-        instance.save(updatedValue);
-        instance = cveDb.reloadProperties();
-        long results = Long.parseLong(instance.getProperty("NVD CVE " + key));
-        assertEquals(expected, results);
-    }
-
     /**
      * Test of getProperty method, of class DatabaseProperties.
      */
diff --git a/core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIT.java b/core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIT.java
deleted file mode 100644
index 90b41674369..00000000000
--- a/core/src/test/java/org/owasp/dependencycheck/data/update/NvdCveUpdaterIT.java
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.update;
-
-import java.util.List;
-import org.junit.Test;
-import org.owasp.dependencycheck.BaseDBTestCase;
-import static org.junit.Assert.assertNotNull;
-import org.owasp.dependencycheck.data.update.nvd.NvdCveInfo;
-
-/**
- *
- * @author Jeremy Long
- */
-public class NvdCveUpdaterIT extends BaseDBTestCase {
-
-    /**
-     * Test of updatesNeeded method.
-     */
-    @Test
-    public void testUpdatesNeeded() throws Exception {
-        NvdCveUpdater instance = new NvdCveUpdater();
-        instance.setSettings(getSettings());
-        instance.initializeExecutorServices();
-        List<NvdCveInfo> result = instance.getUpdatesNeeded();
-        assertNotNull(result);
-    }
-}
diff --git a/core/src/test/java/org/owasp/dependencycheck/data/update/nvd/DownloadTaskTest.java b/core/src/test/java/org/owasp/dependencycheck/data/update/nvd/DownloadTaskTest.java
deleted file mode 100644
index 304cbbd2cdc..00000000000
--- a/core/src/test/java/org/owasp/dependencycheck/data/update/nvd/DownloadTaskTest.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.update.nvd;
-
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Future;
-import org.junit.Test;
-import org.owasp.dependencycheck.BaseTest;
-import org.owasp.dependencycheck.data.nvdcve.CveDB;
-import org.owasp.dependencycheck.utils.Settings;
-import static org.junit.Assert.assertNull;
-
-/**
- *
- * @author Jeremy Long
- */
-public class DownloadTaskTest extends BaseTest {
-
-    /**
-     * Test of call method, of class DownloadTask.
-     */
-    @Test
-    public void testCall() throws Exception {
-        NvdCveInfo cve = new NvdCveInfo("modified",getSettings().getString(Settings.KEYS.CVE_MODIFIED_JSON),1337L);
-        ExecutorService processExecutor = null;
-        CveDB cveDB = null;
-        DownloadTask instance = new DownloadTask(cve, processExecutor, cveDB, getSettings());
-        Future<ProcessTask> result = instance.call();
-        assertNull(result);
-    }
-}
diff --git a/core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfoTest.java b/core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfoTest.java
deleted file mode 100644
index 90c056d69da..00000000000
--- a/core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfoTest.java
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.update.nvd;
-
-import static org.junit.Assert.assertEquals;
-import org.junit.Test;
-import org.owasp.dependencycheck.BaseTest;
-
-/**
- * Rigorous test of getters.
- *
- * @author Jeremy Long
- */
-public class NvdCveInfoTest extends BaseTest {
-
-    /**
-     * Test of setId and getId method, of class NvdCveInfo.
-     */
-    @Test
-    public void testSetGetId() {
-        NvdCveInfo instance = new NvdCveInfo("id","http://www.someurl.com/something", 1337L);
-        String expResult = "id";
-        String result = instance.getId();
-        assertEquals(expResult, result);
-    }
-
-    /**
-     * Test of getUrl method, of class NvdCveInfo.
-     */
-    @Test
-    public void testSetGetUrl() {
-        NvdCveInfo instance = new NvdCveInfo("id","http://www.someurl.com/something", 1337L);
-        String expResult = "http://www.someurl.com/something";
-        String result = instance.getUrl();
-        assertEquals(expResult, result);
-    }
-
-    /**
-     * Test of getTimestamp method, of class NvdCveInfo.
-     */
-    @Test
-    public void testSetGetTimestamp() {
-        NvdCveInfo instance = new NvdCveInfo("id","http://www.someurl.com/something", 1337L);
-        long expResult = 1337L;
-        long result = instance.getTimestamp();
-        assertEquals(expResult, result);
-    }
-}
diff --git a/pom.xml b/pom.xml
index ae65cc799bb..b91ca8098c9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1113,6 +1113,11 @@ Copyright (c) 2012 - Jeremy Long
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <dependency>
+                <groupId>com.fasterxml.jackson.datatype</groupId>
+                <artifactId>jackson-datatype-jsr310</artifactId>
+                <version>${jackson.version}</version>
+            </dependency>
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
diff --git a/utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java b/utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java
index ff34dfc41e9..d0fd5479beb 100644
--- a/utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java
+++ b/utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java
@@ -163,6 +163,39 @@ public static final class KEYS {
          * be imported.
          */
         public static final String CVE_CPE_STARTS_WITH_FILTER = "cve.cpe.startswith.filter";
+        
+        /**
+         * API Key for the NVD API.
+         */
+        public static final String NVD_API_KEY = "nvd.api.key";
+        /**
+         * The properties key to control the skipping of the check for NVD
+         * updates.
+         */
+        public static final String NVD_API_VALID_FOR_HOURS = "nvd.api.check.validforhours";
+        /**
+         * The properties key that indicates how often the NVD API data feed
+         * needs to be updated before a full refresh is evaluated.
+         */
+        public static final String NVD_API_DATAFEED_VALID_FOR_DAYS = "nvd.api.datafeed.validfordays";
+        /**
+         * The URL for the NVD API Data Feed.
+         */
+        public static final String NVD_API_DATAFEED_URL = "nvd.api.datafeed.url";
+        /**
+         * The username to use when connecting to the NVD Data feed.
+         */
+        public static final String NVD_API_DATAFEED_USER = "nvd.api.datafeed.user";
+        /**
+         * The password to authenticate to the NVD Data feed.
+         */
+        public static final String NVD_API_DATAFEED_PASSWORD = "nvd.api.datafeed.password";
+        /**
+         * The starting year for the NVD CVE Data feed cache.
+         */
+        public static final String NVD_API_DATAFEED_START_YEAR = "nvd.api.datafeed.startyear";
+
+        //TODO DELETE BEGIN
         /**
          * The properties key for the URL to retrieve the recently modified and
          * added CVE entries (last 8 days) using the JSON data feeds.
@@ -217,20 +250,6 @@ public static final class KEYS {
          */
         public static final String CVE_DOWNLOAD_WAIT_TIME = "cve.download.waittime";
 
-        /**
-         * API Key for the NVD API.
-         */
-        public static final String NVD_API_KEY = "nvd.api.key";
-        /**
-         * The thread count for downloading from the NVD API.
-         */
-        public static final String NVD_API_THREADCOUNT = "nvd.api.threadcount";
-        /**
-         * The properties key to control the skipping of the check for NVD
-         * updates.
-         */
-        public static final String NVD_API_VALID_FOR_HOURS = "nvd.api.check.validforhours";
-        
         /**
          * The properties key for the telling us how many nvd.url.* URLs exists.
          * This is used in combination with NVD_CACHE_URL to be able to retrieve
@@ -250,7 +269,19 @@ public static final class KEYS {
          * JSON data feeds.
          */
         public static final String NVD_CACHE_URL = "nvd.cache.url";
-
+        /**
+         * The key to determine if the NVD CVE analyzer is enabled.
+         */
+        public static final String ANALYZER_NVD_CVE_ENABLED = "analyzer.nvdcve.enabled";
+        /**
+         * The properties key setting indicating how many days past the new year
+         * that ODC will "skip" updating that years data feed if not present.
+         */
+        public static final String NVD_NEW_YEAR_GRACE_PERIOD = "nvd.newyear.grace.period";
+        //----------------------------------------------------------------------
+        //DELETE END
+        //----------------------------------------------------------------------
+        
         /**
          * The properties key that indicates how often the CPE data needs to be
          * updated.
@@ -751,10 +782,6 @@ public static final class KEYS {
          * The key to determine if the Version Filter analyzer is enabled.
          */
         public static final String ANALYZER_VERSION_FILTER_ENABLED = "analyzer.versionfilter.enabled";
-        /**
-         * The key to determine if the NVD CVE analyzer is enabled.
-         */
-        public static final String ANALYZER_NVD_CVE_ENABLED = "analyzer.nvdcve.enabled";
         /**
          * The key to determine if the Vulnerability Suppression analyzer is
          * enabled.
@@ -842,11 +869,6 @@ public static final class KEYS {
          * sensitive and subsequently masked when logged.
          */
         public static final String MASKED_PROPERTIES = "odc.settings.mask";
-        /**
-         * The properties key setting indicating how many days past the new year
-         * that ODC will "skip" updating that years data feed if not present.
-         */
-        public static final String NVD_NEW_YEAR_GRACE_PERIOD = "nvd.newyear.grace.period";
         /**
          * The properties key for the default max query size for Lucene query
          * results.