aboutcode-org / aboutcode-org/vulnerablecode

Suse scores importer should support version 4

Abierto
#1,592 8 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Python
Estrellas
702
Forks
328
Merge medio
3 d 8 h
PR fusionados (30 d)
3

Descripción

Given a sample Suse score https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml:

```
CVE-2024-35255:
cvss:
- version: 3.1
score: 5.5
vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- version: 4
score: 6.8
vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
```

The version 4 cvss is not imported because the importer does not support version 4:
https://github.com/aboutcode-org/vulnerablecode/blob/ed17dbd5a7537b95faf9ef8d30a95333ffdcb3ca/vulnerabilities/importers/suse_scores.py#L34-L38

Additional questions:

Our VulnerableCode instance contains some weird values for this source:

![image](https://github.com/user-attachments/assets/d6a109ba-5c2c-49d9-a847-0b9c35a5169c)

1. Can the cvssv2 and cvssv3 be old values from previous imports ?
2. Why the cvsv3.1 has a score of 0 ?
3. We noticed the public instance does not list suse.com as a source. Should we disable this importer ?
https://public.vulnerablecode.io/vulnerabilities/VCID-p3vk-v2au-aaaa?search=CVE-2024-35255

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.