Stage/vuls
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(cve/nvd): support CVSS v4.0 (#1979)

Browse Source 
* feat(cve/nvd): support CVSS v4.0

* fix(ci/build/windows): use libc v1.52.1
This commit is contained in:
MaineK00n
2024-07-04 13:39:16 +09:00
committed by GitHub
parent d8173cdd42
commit a76302c111
5 changed files with 49 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
models/utils.go
View File

@@ -119,19 +119,29 @@ func ConvertNvdToModel(cveID string, nvds []cvedict.Nvd) ([]CveContent, []Exploi
c.Cvss3Severity = cvss3.BaseSeverity
m[cvss3.Source] = c
}
for _, cvss40 := range nvd.Cvss40 {
c := m[cvss40.Source]
c.Cvss40Score = cvss40.BaseScore
c.Cvss40Vector = cvss40.VectorString
c.Cvss40Severity = cvss40.BaseSeverity
m[cvss40.Source] = c
}
for source, cont := range m {
cves = append(cves, CveContent{
Type: Nvd,
CveID: cveID,
Summary: strings.Join(desc, "\n"),
Cvss2Score: cont.Cvss2Score,
Cvss2Vector: cont.Cvss2Vector,
Cvss2Severity: cont.Cvss2Severity,
Cvss3Score: cont.Cvss3Score,
Cvss3Vector: cont.Cvss3Vector,
Cvss3Severity: cont.Cvss3Severity,
SourceLink: fmt.Sprintf("https://nvd.nist.gov/vuln/detail/%s", cveID),
Type: Nvd,
CveID: cveID,
Summary: strings.Join(desc, "\n"),
Cvss2Score: cont.Cvss2Score,
Cvss2Vector: cont.Cvss2Vector,
Cvss2Severity: cont.Cvss2Severity,
Cvss3Score: cont.Cvss3Score,
Cvss3Vector: cont.Cvss3Vector,
Cvss3Severity: cont.Cvss3Severity,
Cvss40Score: cont.Cvss40Score,
Cvss40Vector: cont.Cvss40Vector,
Cvss40Severity: cont.Cvss40Severity,
SourceLink: fmt.Sprintf("https://nvd.nist.gov/vuln/detail/%s", cveID),
// Cpes: cpes,
CweIDs: cont.CweIDs,
References: refs,

2
models/vulninfos.go
View File

@@ -610,7 +610,7 @@ func (v VulnInfo) Cvss3Scores() (values []CveContentCvss) {
// Cvss40Scores returns CVSS V4 Score
func (v VulnInfo) Cvss40Scores() (values []CveContentCvss) {
for _, ctype := range []CveContentType{Mitre} {
for _, ctype := range []CveContentType{Mitre, Nvd} {
if conts, found := v.CveContents[ctype]; found {
for _, cont := range conts {
if cont.Cvss40Score == 0 && cont.Cvss40Severity == "" {

18
models/vulninfos_test.go
View File

@@ -1931,6 +1931,15 @@ func TestVulnInfo_Cvss40Scores(t *testing.T) {
Optional: map[string]string{"source": "CNA"},
},
},
Nvd: []CveContent{
{
Type: Nvd,
Cvss40Score: 6.9,
Cvss40Vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
Cvss40Severity: "MEDIUM",
Optional: map[string]string{"source": "cna@vuldb.com"},
},
},
},
},
want: []CveContentCvss{
@@ -1943,6 +1952,15 @@ func TestVulnInfo_Cvss40Scores(t *testing.T) {
Vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
},
},
{
Type: Nvd,
Value: Cvss{
Type: CVSS40,
Score: 6.9,
Severity: "MEDIUM",
Vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
},
},
},
},
}