Documentation
¶
Overview ¶
Package cvss scores CVSS v3 base vectors.
It exists so a report can be sorted by something other than package name. It is deliberately the smallest thing that does that job: base metrics only, no temporal or environmental score, and no attempt to be a general CVSS library.
Only CVSS:3.0 and CVSS:3.1 are scored. v2 is long dead and appears in no record this tool queries; v4.0 does appear, and is not scored on purpose -- its base score is not a formula but a 270-entry MacroVector lookup with an interpolation step over it, which is a great deal of transcribed table to get subtly wrong. An unscored vector reports no severity at all, which is true, rather than a number that looks authoritative and is not.
Index ¶
Constants ¶
const ( Critical = "CRITICAL" High = "HIGH" Medium = "MEDIUM" Low = "LOW" None = "NONE" // Unknown is what an unscorable or absent vector produces. It is a // distinct value rather than an empty string because the difference // between "nobody published a severity" and "the severity is low" is // exactly the difference this tool exists to preserve. Unknown = "UNKNOWN" )
Severity labels, in the vocabulary the report prints.
Variables ¶
This section is empty.
Functions ¶
func Label ¶
Label maps a base score onto the qualitative rating scale from the CVSS v3.1 specification, section 5.
func Normalize ¶
Normalize maps a severity label published by a database onto this package's vocabulary.
The one that matters is GitHub's, which says MODERATE where every other source says MEDIUM. Anything unrecognized becomes Unknown rather than being passed through, so a new spelling from some database cannot land in the report as a severity the sort order does not know about.
func Rank ¶
Rank orders severity labels for display, most urgent first.
Unknown ranks above Medium rather than below Low, which is the one choice here that is not simply the scale. A severity nobody published is not evidence that the problem is small, and sorting it to the bottom of a several-hundred-row report is how it stops being read at all. Putting it above the ratings we know to be middling costs a little precision in the ordering and buys the property that no finding is quietly demoted for missing metadata.
func Score ¶
Score returns the CVSS base score for a v3 vector.
The second return is false for anything it will not score: another CVSS version, a vector missing a base metric, or an unrecognized metric value. Callers must treat that as "no severity", never as zero -- a 0.0 base score is a real CVSS answer meaning no impact.
Types ¶
This section is empty.
Source Files