PSIRT OpenVuln API: issue with IOS versions

[emanuele-disalvia]

Hi,

I am using the PSIRT APIs to fetch the exact same data as shown here. However, I'm encountering an issue with the IOS parameter in the API.

The following calls work correctly (as of today):

• IOS XR Software
  • [GET] https://apix.cisco.com/security/advisories/v2/product?product=Cisco%20IOS%20XR%20Software
    • Total results: 154
  • CIsco Security Advisories filtered page
    • Total results: 154
• IOS XE Software
  • [GET] https://apix.cisco.com/security/advisories/v2/product?product=Cisco%20IOS%20XE%20Software
    • Total results: 398
  • CIsco Security Advisories filtered page
    • Total results: 398
• NX-OS Software
  • [GET] https://apix.cisco.com/security/advisories/v2/product?product=Cisco%20NX%20OS%20Software
    • Total results: 229
  • Cisco Security Advisories filtered page
    • Total results: 229

 Except for this one:

• IOS
  • [GET] https://apix.cisco.com/security/advisories/v2/product?product=IOS
    • Total results: 721
  • Cisco Security Advisories filtered page
    • Total results: 285

It seems like the "IOS" parameter of the PSIRT APIs works as a "LIKE" query, so it's getting the results of IOS XE, IOS XR, IOS ROMMON, Jabber for IOS and so on. Is there a way to retrieve, via the APIs, the same IOS advisories as displayed on the page, which shows 285 results?

Thank you

Emanuele Di Salvia

[Torbjørn]

As far as I can see there is no way to achieve this with the PSIRT API as it is today. You will either have to filter the results based on the "productNames" field in the response, or request a change to the API through support/your Cisco contact. It would be great to be able to be able to filter based on "resourceId" or exact name.

If your usecase is non-critical and doesn't need to be supported, you can fetch this data using the same API as the website like this(requires pagination, max limit seems to be 100):

 curl -X GET -H "Accept: application/json" "https://sec.cloudapps.cisco.com/security/center/publicationService.x?limit=100&offset=0&publicationTypeIDs=1,3&resourceIDs=2097" 

[emanuele-disalvia]

Hi Torbjørn,

thank you for your answer.
Actually I am trying to download the CSAF using the "csafUrl" key from each advisory in the PSIRT API response.
While your curl command helps me with fetching all the data I need and build the "csafUrl" using the "identifier", it's not the most efficient method.
As you suggested, updating the APIs in order to retrieve data using "resourceIDs" would be more beneficial.

If you have any further suggestions or improvements, please let me know.
I appreciate your time and assistance!

Emanuele