Is it possible to get both the fixed and open vulnerabilities of a project for a given time range?

[CsatariGergely]

We would like to run an analyzis on how quickly projects fix the vulnerabilities. For this we would need to get information about both the fixed and open vulnerabilities.

[andrewpollock]

Hi @CsatariGergely

For ad hoc analysis to answer questions like these, you're going to be best served by looking at the data exports we make available.

You can either do custom analysis with jq or make other transformations of the data to make it more amenable to analysis by your preferred methods.

Please do share your findings and also your user journeys so we can look at making things easier for making these types of insights.

To give you a bit of a start, here's a jq query that I recently had to cook up to identify unwithdrawn vulnerabilities that didn't have a a ceiling for a fix commit:

find /tmp/osv-vulnerabilities -name CVE-*.json | xargs jq -r 'select(has("withdrawn") | not) | select(.affected[] | select(.ranges[] | select(.type == "GIT" and (.events | any(has("introduced")) and all(has("fixed") | not) and all(has("last_affected") | not)))) ) | .id'

[CsatariGergely]

Thanks for the answer. We will try this out.
How frequent the data exports are?

[another-rex]

Currently we are exporting them every hour, though we plan to increase that to every 30 minutes soon.

[CsatariGergely]

Wow, okey, that is frequent enough :)