aboutcode-org / aboutcode-org/vulnerablecode

Improve Severity System data - For Canonical/Ubuntu we report Ubuntu Priority as Severity

Abierto
#1,742 1 comentario 0 reacciones 2 asignados Reclamado por @TG1999 Ver en GitHub
design-needed
Lenguaje dominante
Python
Estrellas
702
Forks
328
Merge medio
3 d 8 h
PR fusionados (30 d)
3

Descripción

While reviewing a large set of Vuln references from Canonical I noticed that we are reporting Ubuntu Priority in the Severity field.
Some examples are:
- http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-17360.html
- http://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-32815.html

(most of these are relatively old Vulns)

The Ubuntu Priority data is not a CVSS score and is often paired with the original CVSS Severity data from the NVD.
The general explanation from: https://ubuntu.com/security/cves/about#priority is: "The Ubuntu priority is based on many factors including severity, importance, risk, estimated number of affected users, software configuration, active exploitation, and other factors which may adjust the impact of certain vulnerabilities such as Ubuntu’s [proactive security features](https://wiki.ubuntu.com/Security/Features#Matrix)."

So this Priority is more like an assessment of the impact on an Ubuntu package which is useful - perhaps close to VEX type information.
The point of this Issue is to design how to present this type of information to make its meaning more clear. Perhaps in this case the System should be ubuntu-priority instead of generic_textual.

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.