This is under the assumption that v3.1 score should take precedence over v3.0 For CVE-2018-16840 there is a v3.1 score of 9.8 and a v3.0 score of 4.3. I image that and v3.1 score should override v3.0 score. Otherwise add another field to capture both scores. CVE for curl { "id": "CVE-2018-16840", ..... "scorev2": "7.5", "scorev3": "4.3", "scorev4": "0.0", ..... "link": "https://nvd.nist.gov/vuln/detail/CVE-2018-16840" }, Code in cve-update-nvd2-native.bb try: accessVector = accessVector or elt['cve']['metrics']['cvssMetricV30'][0]['cvssData']['attackVector'] vectorString = vectorString or elt['cve']['metrics']['cvssMetricV30'][0]['cvssData']['vectorString'] cvssv3 = elt['cve']['metrics']['cvssMetricV30'][0]['cvssData']['baseScore'] except KeyError: pass try: accessVector = accessVector or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['attackVector'] vectorString = vectorString or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['vectorString'] cvssv3 = cvssv3 or elt['cve']['metrics']['cvssMetricV31'][0]['cvssData']['baseScore'] except KeyError: pass cvssv3 = cvssv3 or 0.0
Hi Prosper, Can you send a patch to the oe-core list? https://docs.yoctoproject.org/contributor-guide/index.html Also, what systems from Fluke are using Yocto?
Perhaps Archana would be willing to work on this but only if she has time and interest.
I have attempted to fix this issue by adding all CVSS score versions to the database and cve-check report. See the linked thread below. https://lists.openembedded.org/g/openembedded-core/topic/109850435#msg208046 IIRC there was some back and forth in the developers meeting because of some rework that Marta was adding for the CVE database fetcher recipes. I'd be happy to pick up my patch again and get it merged if that would be considered helpful. I think the big question is for the LTS versions, should the current score logic be left as-is to not break any compatibility issues, or should the logic be inverted to include the latest CVSS score version that exists for a given CVE? Regardless, I could also create a new key with an object or list containing all CVSS scores.
Maybe related patch: [scarthgap] [PATCH] Fix CVE CVSS scoring to use maximum score from all sources https://lists.openembedded.org/g/openembedded-core/message/229229
[PATCH v2] cve-update-nvd2-native: Use maximum CVSS score from all sources https://lists.openembedded.org/g/openembedded-core/topic/patch_v2/117379016 This patch points here but this may be subtly different: * This bug is about aggregating CVSS score from different version * The patch is about aggregating CVSS scores from multiple disagreeing sources.
I'd personally really like cve-check to include all CVSS version vector strings and scores, not just the maximum. I think at that point users of the cve-check output can be fully informed with all score data and determine which they should use. As it's currently implemented, I don't really use any of the CVSS score or vector information included by CVE check and instead use post-processing tooling to enrich the cve-check output with all available CVSS data from NVD.
Colin, Did you really intend to move the defect milestone to "Future"? If so, maybe we should move it to 6.0, unassigned. Note that I'm not following the bug discussion closely since I'm allergic to CVEs! ;-)
(In reply to Yoann Congal from comment #5) > [PATCH v2] cve-update-nvd2-native: Use maximum CVSS score from all sources > https://lists.openembedded.org/g/openembedded-core/topic/patch_v2/117379016 > > This patch points here but this may be subtly different: > * This bug is about aggregating CVSS score from different version > * The patch is about aggregating CVSS scores from multiple disagreeing > sources. This patch got merged, but above comment about differences still applies. https://git.openembedded.org/openembedded-core/commit/?id=4f6192f3165de0bc2499e045607c7e7ffd878a4b