Documentation
¶
Overview ¶
Package cvss scores CVSS v3 base vectors.
It exists so a report can be sorted by something other than package name. It is deliberately the smallest thing that does that job: base metrics only, no temporal or environmental score, and no attempt to be a general CVSS library.
Only CVSS:3.0 and CVSS:3.1 are scored. v2 is long dead and appears in no record this tool queries; v4.0 does appear, and is not scored on purpose -- its base score is not a formula but a 270-entry MacroVector lookup with an interpolation step over it, which is a great deal of transcribed table to get subtly wrong. An unscored vector reports no severity at all, which is true, rather than a number that looks authoritative and is not.
Index ¶
Constants ¶
const ( Critical = "CRITICAL" High = "HIGH" Medium = "MEDIUM" Low = "LOW" None = "NONE" // Unknown is what an unscorable or absent vector produces. It is a // distinct value rather than an empty string because the difference // between "nobody published a severity" and "the severity is low" is // exactly the difference this tool exists to preserve. Unknown = "UNKNOWN" )
Severity labels, in the vocabulary the report prints.
Variables ¶
Labels is every severity in this package's vocabulary, in Rank order.
Anything that walks the severities -- a summary line, a --severity flag's help text, the set of names that flag accepts -- walks this, so a seventh label cannot be taught to one of them and not the others.
Functions ¶
func Display ¶ added in v0.4.0
Display is the label to show a reader, and the one to filter on.
An empty label means no advisory was resolved for the finding at all, which is not the same fact as an advisory that published no rating -- the resolver keeps them distinct on purpose. To a reader deciding what to look at they are the same fact, so both arrive here as UNKNOWN rather than one of them rendering as a blank cell or slipping through a severity filter.
func Label ¶
Label maps a base score onto the qualitative rating scale from the CVSS v3.1 specification, section 5.
func Normalize ¶
Normalize maps a severity label published by a database onto this package's vocabulary.
The one that matters is GitHub's, which says MODERATE where every other source says MEDIUM. Anything unrecognized becomes Unknown rather than being passed through, so a new spelling from some database cannot land in the report as a severity the sort order does not know about.
func Parse ¶ added in v0.4.0
Parse maps a severity a user typed onto this package's vocabulary, strictly.
Unlike Normalize, an unrecognized name fails instead of becoming Unknown. That difference is the whole reason this exists: Normalize("CRITCAL") is UNKNOWN, so a typo in --severity would silently ask for exactly the unrated findings rather than the critical ones -- the worst available misreading of the intent. A caller with a typo gets an error and a list of the real names.
func Rank ¶
Rank orders severity labels for display, most urgent first.
Unknown ranks above Medium rather than below Low, which is the one choice here that is not simply the scale. A severity nobody published is not evidence that the problem is small, and sorting it to the bottom of a several-hundred-row report is how it stops being read at all. Putting it above the ratings we know to be middling costs a little precision in the ordering and buys the property that no finding is quietly demoted for missing metadata.
func Score ¶
Score returns the CVSS base score for a v3 vector.
The second return is false for anything it will not score: another CVSS version, a vector missing a base metric, or an unrecognized metric value. Callers must treat that as "no severity", never as zero -- a 0.0 base score is a real CVSS answer meaning no impact.
Types ¶
This section is empty.
Source Files