aboutcode-org / aboutcode-org/vulnerablecode

severity vectors bug: Do not list ALL duplicated severity vectors in the UI. Also display the score

未關閉
#1,729 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
bug ui
主要語言
Python
星號
702
分支
328
平均合併
3 天 8 小時
30 天內合併 PR
3

描述

We should not list ALL duplicated severity vectors in the UI and we should display the score.
See https://public2.vulnerablecode.io/vulnerabilities/VCID-hh72-ne73-aaak

There is a list of 234 vectors!

We really have a handful of them:

> Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
> Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N
> Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
> Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
> Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
> Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
> Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-02T18:16:07Z/

1. This is a bug: `Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P`
2. We should not list vectors without a score and URL to the original reference, as this is devoid of meaning
3. We should list only unique vectors and a list of references
4. A free standing vector has no meaning in many cases. It is always attached to specific packaging.

貢獻指南

這個儲存庫沒有索引到貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。