-
Notifications
You must be signed in to change notification settings - Fork 6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Invalid CVSS v2 environmental score computation #33
Comments
Release v1.6.4. |
It was not fixed properly, as the vector |
Adjusted calculation error of CVSSv2 Base score (issue #33)
Hmmm... Released v1.6.5. Is it OK? |
Now, the vector |
Fixed bug of Calculation of CVSSv2 Environmental score (issue #33)
Sorry! Released v1.6.6. |
Thank you for many advices. |
Sorry, I still have some issues to raise about this, but I first need to fix the NVD due to the same issue :') |
Hi, sorry for the looong wait, seems like they won't fix it... So here is the issue ! Let's take again the CVSS v2 vector "AV:A/AC:L/Au:N/C:C/I:C/A:C/CDP:H/TD:H/CR:L/IR:ND/AR:ND" with Base and Environmental groups defined. |
🤔 ... |
Hey, any news on fixing it ? |
sorry. |
Oh, I'm sorry to hear that. If you think this is appropriate maybe archive the project to let it available while read-only. Hope you do well |
…h the specifications (#651) ## Why this PR [CVSS v4.0](https://www.first.org/cvss/v4-0/) has been released lately, and the OSV will most probably add its support (the first CVSS v4.0 vector known to the FIRST.ORG SIG CVSS has been published [by Palo Alto Networks for the CVE-2023-3282](https://security.paloaltonetworks.com/CVE-2023-3282)). As a FIRST.ORG SIG CVSS member and [Go CVSS implementation](https://github.com/pandatix/go-cvss) maintainer, I'm looking forward to improve its adoption and understanding in the Open-Source Ecosystem. Moreover, there exist issues with the currently used CVSS implementation, such as [invalid scoring computation](goark/go-cvss#33), and [CVSS v4.0 is currently not planned for support](goark/go-cvss#37 (comment)). ## What it brings With the current PR, I provide multiple direct improvements: - proper CVSS v2.0 scoring computation (only affect the environmental score computation, but has been an unresolved issue for months) - add support of CVSS v4.0 in the OSV schema - performance improvements according to [benchmarks](https://github.com/pandatix/go-cvss#comparison) Given ossf/osv-schema#166 the CVSS v4.0 key will most likely be `CVSS_V4` to align with the previous CVSS versions support. ## Is it breaking ? For the code, no, but for the Go version, yes 🎉
During differential fuzzing with
github.com/pandatix/go-cvss
I discovered that your implementation does not properly computes CVSS v2 environmental scores (as for #18).For instance, the vector
AV:A/AC:L/Au:N/C:C/I:C/A:C/CDP:H/TD:H/CR:L/IR:ND/AR:ND
have an environmental score of 9.0, according to the NVD CVSS v2 calculator. Nevertheless, the following Go code illustrates this issue i.e. invalid scores.produces ->
The text was updated successfully, but these errors were encountered: