Skip to content

Commit 2d115aa

Browse files
ahouseholderahouseholder
authored
Split CVSS equivalence sets (#685)
* split eq1 into separate module * split EQ2-6 into separate modules
1 parent 3008938 commit 2d115aa

File tree

9 files changed

+356
-195
lines changed

9 files changed

+356
-195
lines changed

‎src/ssvc/_mixins.py‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
#!/usr/bin/env python
22
"""
3-
file: _basics
4-
author: adh
5-
created_at: 9/20/23 4:51 PM
3+
This module provides mixin classes for adding features to SSVC objects.
64
"""
75
# Copyright (c) 2023-2025 Carnegie Mellon University and Contributors.
86
# - see Contributors.md for a full list of Contributors

‎src/ssvc/decision_points/cvss/eq_sets.py‎

Lines changed: 0 additions & 191 deletions
This file was deleted.

‎src/ssvc/decision_points/cvss/equivalence_set_1.py‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#!/usr/bin/env python
2+
"""
3+
Provides an object representing the CVSS Equivalence Set 1 as a decision point.
4+
"""
5+
# Copyright (c) 2025 Carnegie Mellon University and Contributors.
6+
# - see Contributors.md for a full list of Contributors
7+
# - see ContributionInstructions.md for information on how you can Contribute to this project
8+
# Stakeholder Specific Vulnerability Categorization (SSVC) is
9+
# licensed under a MIT (SEI)-style license, please see LICENSE.md distributed
10+
# with this Software or contact [email protected] for full terms.
11+
# Created, in part, with funding and support from the United States Government
12+
# (see Acknowledgments file). This program may include and/or can make use of
13+
# certain third party source code, object code, documentation and other files
14+
# (“Third Party Software”). See LICENSE.md for more details.
15+
# Carnegie Mellon®, CERT® and CERT Coordination Center® are registered in the
16+
# U.S. Patent and Trademark Office by Carnegie Mellon University
17+
18+
from ssvc.decision_points import SsvcDecisionPointValue
19+
from ssvc.decision_points.cvss.base import CvssDecisionPoint
20+
from ssvc.decision_points.helpers import print_versions_and_diffs
21+
22+
TWO = SsvcDecisionPointValue(
23+
name="Low",
24+
key="L",
25+
description="2: AV:P or not(AV:N or PR:N or UI:N)",
26+
)
27+
28+
ONE = SsvcDecisionPointValue(
29+
name="Medium",
30+
key="M",
31+
description="1: (AV:N or PR:N or UI:N) and not (AV:N and PR:N and UI:N) and not AV:P",
32+
)
33+
34+
ZERO = SsvcDecisionPointValue(
35+
name="High",
36+
key="H",
37+
description="0: AV:N and PR:N and UI:N",
38+
)
39+
40+
# EQ1 → AV/PR/UI with 3 levels specified in Table 24
41+
# Levels Constraints Highest Severity Vector(s)
42+
# 0 AV:N and PR:N and UI:N AV:N/PR:N/UI:N
43+
# 1 (AV:N or PR:N or UI:N) and not (AV:N and PR:N and UI:N) and not AV:P AV:A/PR:N/UI:N or AV:N/PR:L/UI:N or AV:N/PR:N:/UI:P
44+
# 2 AV:P or not(AV:N or PR:N or UI:N) AV:P/PR:N/UI:N or AV:A/PR:L/UI:P
45+
EQ1 = CvssDecisionPoint(
46+
name="Equivalence Set 1",
47+
key="EQ1",
48+
description="AV/PR/UI with 3 levels specified in Table 24",
49+
version="1.0.0",
50+
values=(
51+
TWO,
52+
ONE,
53+
ZERO,
54+
),
55+
)
56+
57+
VERSIONS = (EQ1,)
58+
LATEST = EQ1
59+
60+
61+
def main():
62+
print_versions_and_diffs(VERSIONS)
63+
64+
65+
if __name__ == "__main__":
66+
main()

‎src/ssvc/decision_points/cvss/equivalence_set_2.py‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/usr/bin/env python
2+
"""
3+
This module provides an object representing the CVSS Equivalence Set 2 as a decision point.
4+
"""
5+
# Copyright (c) 2025 Carnegie Mellon University and Contributors.
6+
# - see Contributors.md for a full list of Contributors
7+
# - see ContributionInstructions.md for information on how you can Contribute to this project
8+
# Stakeholder Specific Vulnerability Categorization (SSVC) is
9+
# licensed under a MIT (SEI)-style license, please see LICENSE.md distributed
10+
# with this Software or contact [email protected] for full terms.
11+
# Created, in part, with funding and support from the United States Government
12+
# (see Acknowledgments file). This program may include and/or can make use of
13+
# certain third party source code, object code, documentation and other files
14+
# (“Third Party Software”). See LICENSE.md for more details.
15+
# Carnegie Mellon®, CERT® and CERT Coordination Center® are registered in the
16+
# U.S. Patent and Trademark Office by Carnegie Mellon University
17+
18+
from ssvc.decision_points import SsvcDecisionPointValue
19+
from ssvc.decision_points.cvss.base import CvssDecisionPoint
20+
from ssvc.decision_points.helpers import print_versions_and_diffs
21+
22+
# EQ2 → AC/AT with 2 levels specified in Table 25
23+
# Levels Constraints Highest Severity Vector(s)
24+
# 0 AC:L and AT:N AC:L/AT:N
25+
# 1 not (AC:L and AT:N) AC:L/AT:P or AC:H/AT:N
26+
ONE = SsvcDecisionPointValue(
27+
name="Low",
28+
key="L",
29+
description="1: not (AC:L and AT:N)",
30+
)
31+
ZERO = SsvcDecisionPointValue(
32+
name="High",
33+
key="H",
34+
description="0: AC:L and AT:N",
35+
)
36+
37+
EQ2 = CvssDecisionPoint(
38+
name="Equivalence Set 2",
39+
key="EQ2",
40+
description="AC/AT with 2 levels specified in Table 25",
41+
version="1.0.0",
42+
values=(
43+
ONE,
44+
ZERO,
45+
),
46+
)
47+
48+
VERSIONS = (EQ2,)
49+
LATEST = VERSIONS[-1]
50+
51+
52+
def main():
53+
print_versions_and_diffs(VERSIONS)
54+
55+
56+
if __name__ == "__main__":
57+
main()

‎src/ssvc/decision_points/cvss/equivalence_set_3.py‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/usr/bin/env python
2+
"""
3+
This module provides an object representing the CVSS Equivalence Set 3 as a decision point.
4+
"""
5+
# Copyright (c) 2025 Carnegie Mellon University and Contributors.
6+
# - see Contributors.md for a full list of Contributors
7+
# - see ContributionInstructions.md for information on how you can Contribute to this project
8+
# Stakeholder Specific Vulnerability Categorization (SSVC) is
9+
# licensed under a MIT (SEI)-style license, please see LICENSE.md distributed
10+
# with this Software or contact [email protected] for full terms.
11+
# Created, in part, with funding and support from the United States Government
12+
# (see Acknowledgments file). This program may include and/or can make use of
13+
# certain third party source code, object code, documentation and other files
14+
# (“Third Party Software”). See LICENSE.md for more details.
15+
# Carnegie Mellon®, CERT® and CERT Coordination Center® are registered in the
16+
# U.S. Patent and Trademark Office by Carnegie Mellon University
17+
18+
from ssvc.decision_points import SsvcDecisionPointValue
19+
from ssvc.decision_points.cvss.base import CvssDecisionPoint
20+
from ssvc.decision_points.helpers import print_versions_and_diffs
21+
22+
# EQ3 → VC/VI/VA with 3 levels specified in Table 26
23+
# Levels Constraints Highest Severity Vector(s)
24+
# 0 VC:H and VI:H VC:H/VI:H/VA:H
25+
# 1 not (VC:H and VI:H) and (VC:H or VI:H or VA:H) VC:L/VI:H/VA:H or VC:H/VI:L/VA:H
26+
# 2 not (VC:H or VI:H or VA:H) VC:L/VI:L/VA:L
27+
TWO = SsvcDecisionPointValue(
28+
name="Low",
29+
key="L",
30+
description="2: not (VC:H or VI:H or VA:H)",
31+
)
32+
ONE = SsvcDecisionPointValue(
33+
name="Medium",
34+
key="M",
35+
description="1: not (VC:H and VI:H) and (VC:H or VI:H or VA:H)",
36+
)
37+
ZERO = SsvcDecisionPointValue(
38+
name="High",
39+
key="H",
40+
description="0: VC:H and VI:H",
41+
)
42+
43+
EQ3 = CvssDecisionPoint(
44+
name="Equivalence Set 3",
45+
key="EQ3",
46+
description="VC/VI/VA with 3 levels specified in Table 26",
47+
version="1.0.0",
48+
values=(
49+
TWO,
50+
ONE,
51+
ZERO,
52+
),
53+
)
54+
55+
56+
VERSIONS = (EQ3,)
57+
LATEST = VERSIONS[-1]
58+
59+
60+
def main():
61+
print_versions_and_diffs(VERSIONS)
62+
63+
64+
if __name__ == "__main__":
65+
main()

0 commit comments

Comments
 (0)