FIRSTdotorg / FIRSTdotorg/cvss-resources
CVSSv4 Reference Score Discrepancies
- Dominant language
- JavaScript
- Stars
- 12
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
While qualifying my own CVSSv4 implementation, I found that 159 entries in the retained [`reference-scores`](https://github.com/FIRSTdotorg/cvss-resources/tree/48f85d84a036de9c610668f9496c12b5040a9ae3/vectorFiles/reference-scores) corpus disagree with the later RedHat calculator revision.
Observed discrepancies:
- 159 affected corpus entries
- 157 unique vectors
- every score changes by exactly +0.1
- no resulting severity changes
The differences appear to follow the floating-point adjustment introduced by [`RedHatProductSecurity/cvss-v4-calculator@7faaaa5`](https://github.com/RedHatProductSecurity/cvss-v4-calculator/commit/7faaaa5662d7c94e160c1193c96a970ced773301). I have retained an [executable generator](https://github.com/cticommons/cvss/tree/v1.1.1/differential/cmd/cvss40-corrections) which verifies the pinned calculator and corpus by exact length and SHA-256 before reproducing the [157 corrections](https://github.com/cticommons/cvss/blob/v1.1.1/testdata/first/v40-rounding-corrections.json)
Is reference-scores expected to be updated for the later rounding behaviour or is the older output intentional?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing the pinned reference-scores corpus and the linked RedHat calculator revision, then run the retained differential/cmd/cvss40-corrections generator. Compare its verified 157 corrections with testdata/first/v40-rounding-corrections.json; the issue is resolved when the expected corpus behavior and whether an update is needed are established.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100