search

haskell / security-advisories

https://haskell.github.io/security-advisories/
Other
46 stars 18 forks source link

add CVSS 4.0 support #167

Open frasertweedale opened 8 months ago

frasertweedale commented 8 months ago

Summary

CVSS 4.0 is here, and already supported by OSV. Add support for it in our cvss lib and hsec-tools.

unorsk commented 5 months ago

Hey! I'll take this one! :)

TristanCacqueray commented 5 months ago

@unorsk Thanks! I wrote the initial CVSS library, please let me know if you need any help.

unorsk commented 5 months ago

Started working on this. No wonder this hasn't been implemented yet 😅 The way they changed the scoring system isn't very straightforward... but it's fun :)

TristanCacqueray commented 5 months ago

It seems like you can find an JavaScript implementation in https://www.first.org/cvss/calculator/app.js?v=7 . Looks pretty onerous, good luck!

unorsk commented 5 months ago

It seems like you can find an JavaScript implementation in https://www.first.org/cvss/calculator/app.js?v=7 . Looks pretty onerous, good luck!

Yeah, thanks! It looks like it's just an embedded (and a bit outdated) version of this one

frasertweedale commented 5 months ago

Might be better to just read the spec: https://www.first.org/cvss/v4.0/specification-document and test the implementation using the official examples: https://www.first.org/cvss/v4.0/examples