aboutcode-org / aboutcode-org/vulnerablecode

Improve Severity System data - For Canonical/Ubuntu we report Ubuntu Priority as Severity

未關閉
#1,742 1 則留言 0 個 reaction 已指派 2 人 已被 @TG1999 認領 在 GitHub 檢視
design-needed
主要語言
Python
星號
702
分支
328
平均合併
3 天 8 小時
30 天內合併 PR
3

描述

While reviewing a large set of Vuln references from Canonical I noticed that we are reporting Ubuntu Priority in the Severity field.
Some examples are:
- http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-17360.html
- http://people.canonical.com/~ubuntu-security/cve/2021/CVE-2021-32815.html

(most of these are relatively old Vulns)

The Ubuntu Priority data is not a CVSS score and is often paired with the original CVSS Severity data from the NVD.
The general explanation from: https://ubuntu.com/security/cves/about#priority is: "The Ubuntu priority is based on many factors including severity, importance, risk, estimated number of affected users, software configuration, active exploitation, and other factors which may adjust the impact of certain vulnerabilities such as Ubuntu’s [proactive security features](https://wiki.ubuntu.com/Security/Features#Matrix)."

So this Priority is more like an assessment of the impact on an Ubuntu package which is useful - perhaps close to VEX type information.
The point of this Issue is to design how to present this type of information to make its meaning more clear. Perhaps in this case the System should be ubuntu-priority instead of generic_textual.

貢獻指南

這個儲存庫沒有索引到貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。