aboutcode-org / aboutcode-org/vulnerablecode

severity vectors bug: Do not list ALL duplicated severity vectors in the UI. Also display the score

Ouverte
#1,729 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
bug ui
Langage dominant
Python
Étoiles
702
Forks
328
Merge moyen
3 j 8 h
PR mergées (30 j)
3

Description

We should not list ALL duplicated severity vectors in the UI and we should display the score.
See https://public2.vulnerablecode.io/vulnerabilities/VCID-hh72-ne73-aaak

There is a list of 234 vectors!

We really have a handful of them:

> Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
> Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N
> Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
> Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
> Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
> Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
> Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-02T18:16:07Z/

1. This is a bug: `Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P`
2. We should not list vectors without a score and URL to the original reference, as this is devoid of meaning
3. We should list only unique vectors and a list of references
4. A free standing vector has no meaning in many cases. It is always attached to specific packaging.

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.