FIRSTdotorg / FIRSTdotorg/cvss-resources

CVSSv4 Reference Score Discrepancies

Open
#3 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
12
Forks
2
PR merge metrics
No merged PRs in 30d

Description

While qualifying my own CVSSv4 implementation, I found that 159 entries in the retained [`reference-scores`](https://github.com/FIRSTdotorg/cvss-resources/tree/48f85d84a036de9c610668f9496c12b5040a9ae3/vectorFiles/reference-scores) corpus disagree with the later RedHat calculator revision.

Observed discrepancies:
- 159 affected corpus entries
- 157 unique vectors
- every score changes by exactly +0.1
- no resulting severity changes

The differences appear to follow the floating-point adjustment introduced by [`RedHatProductSecurity/cvss-v4-calculator@7faaaa5`](https://github.com/RedHatProductSecurity/cvss-v4-calculator/commit/7faaaa5662d7c94e160c1193c96a970ced773301). I have retained an [executable generator](https://github.com/cticommons/cvss/tree/v1.1.1/differential/cmd/cvss40-corrections) which verifies the pinned calculator and corpus by exact length and SHA-256 before reproducing the [157 corrections](https://github.com/cticommons/cvss/blob/v1.1.1/testdata/first/v40-rounding-corrections.json)

Is reference-scores expected to be updated for the later rounding behaviour or is the older output intentional?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the pinned reference-scores corpus and the linked RedHat calculator revision, then run the retained differential/cmd/cvss40-corrections generator. Compare its verified 157 corrections with testdata/first/v40-rounding-corrections.json; the issue is resolved when the expected corpus behavior and whether an update is needed are established.

Written by the indexing model from the issue text.

Assessment

Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.