-
Notifications
You must be signed in to change notification settings - Fork 202
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Suse scores importer should support version 4 #1592
Comments
@ziadhany has recently added support for CVSSv4 #1473, and we need to make sure we collect them in each importers.
Suse doesn't have CVSSv2 and CVSSv3 scores for
This looks like a bug, either in the data or in the importer itself. We would need the history to confirm it.
We do run the |
Unfortunately, the history tab of the CVE-2024-35255 is empty in our VulnerableCode instance 😞 |
This doesn't feel right. Can you share which version/commit of VulnerableCode you're running locally? |
We started our importers yesterday, and today we do have a suse score for |
You get the entries for cvssv2 and cvssv3 too ! Any idea why ? |
@nnobelis Thanks for reporting this. It took some time to reproduce the issue, and after much digging it turns out this is a bug. The bug is in how we handle the See the SUSE scores |
Great find, thanks for looking into this ! |
Given a sample Suse score https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml:
The version 4 cvss is not imported because the importer does not support version 4:
vulnerablecode/vulnerabilities/importers/suse_scores.py
Lines 34 to 38 in ed17dbd
Additional questions:
Our VulnerableCode instance contains some weird values for this source:
https://public.vulnerablecode.io/vulnerabilities/VCID-p3vk-v2au-aaaa?search=CVE-2024-35255
The text was updated successfully, but these errors were encountered: