Skip to content

Add CVSSv4 support to Dependency-Track #5456

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tobiasgies wants to merge 28 commits into from
Closed

Add CVSSv4 support to Dependency-Track #5456

Show file tree
Hide file tree
Changes from 27 commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
ec1e8ff
Add CVSSv4 fields to vulnerabilty DBO and corresponding DB update
tobiasgies Oct 17, 2025
2fdbc0d
Add CVSSv4 handling to VulnerabilityUtil
tobiasgies Oct 17, 2025
ef99b86
Add CVSSv4 handling to VulnerabilityResource
tobiasgies Oct 17, 2025
5c6ebd0
Add v4.14.0 updater to UpgradeItems
tobiasgies Oct 17, 2025
33fccc0
Add CVSSv4 score handling to Finding and GroupedFinding models
tobiasgies Oct 17, 2025
bb01cc6
Use new version of getSeverity method in v4.11.0 Updater
tobiasgies Oct 17, 2025
e1d4974
Add CVSSv4 handling to GHSA, NVD and VulnDB importers (if provided)
tobiasgies Oct 17, 2025
9bc6113
Add CVSSv4 handling to Sonatype OSS Index Analyser
tobiasgies Oct 17, 2025
48729ce
Add todo reminder for revision tomorrow
tobiasgies Oct 17, 2025
ea3ae1f
Rework: CVSSv4 doesn't have exploitability and impact subscores, but …
tobiasgies Oct 20, 2025
ec66cc7
Add CVSS4 fields in more places
tobiasgies Oct 20, 2025
a6e4da9
Repair some tests broken by the changes so far; fix GroupedFinding no…
tobiasgies Oct 20, 2025
af0891a
Repair more broken tests
tobiasgies Oct 20, 2025
ca0d7b0
Add more tests for Vulnerability DBO
tobiasgies Oct 21, 2025
c2e8d38
Add cvssv4 field to new vulnerability notification
tobiasgies Oct 21, 2025
34a1434
Add cvssv4 handling to CycloneDX parser
tobiasgies Oct 21, 2025
6a67fa4
Add CVSSv4 handling to OSV paser
tobiasgies Oct 21, 2025
b8bdf6a
Add CVSSv4 parsing to Trivy parser. Updates Trivy protobuf definition…
tobiasgies Oct 21, 2025
1d43c62
Ensure calculator resource has basic CVSSv4 calculation capability
tobiasgies Oct 21, 2025
348f35a
Add ability to filter findings by CVSSv4 score to FindingResource
tobiasgies Oct 21, 2025
639befc
Ensure NIST API mirror task successfully parses CVSS4-scored vulnerab…
tobiasgies Oct 21, 2025
d2b83b0
Ensure NIST mirror task successfully parses CVSS4-scored vulnerabilities
tobiasgies Oct 21, 2025
e4c8745
Fix copy/paste error in query parameters
tobiasgies Oct 22, 2025
7cf0e2c
Ensure advisories with CVSS 4 scores get parsed correctly in OsvDownl…
tobiasgies Oct 22, 2025
abffd2e
Ensure advisories with CVSS 4 scores get parsed correctly in TrivyAna…
tobiasgies Oct 28, 2025
cda9018
Add missing validation to VulnerabilityResource and some more CVSS4 t…
tobiasgies Oct 28, 2025
f7dc16c
Fix copy/paste error in parameter description
tobiasgies Oct 28, 2025
e983b98
Increase timeout for testNotificationRuleTest because it has become f…
tobiasgies Oct 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 22 additions & 19 deletions src/main/java/org/dependencytrack/model/Finding.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ public class Finding implements Serializable {
, "VULNERABILITY"."SEVERITY"
, "VULNERABILITY"."CVSSV2BASESCORE"
, "VULNERABILITY"."CVSSV3BASESCORE"
, "VULNERABILITY"."CVSSV4BASESCORE"
, "VULNERABILITY"."OWASPRRLIKELIHOODSCORE"
, "VULNERABILITY"."OWASPRRTECHNICALIMPACTSCORE"
, "VULNERABILITY"."OWASPRRBUSINESSIMPACTSCORE"
Expand Down Expand Up @@ -125,6 +126,7 @@ public class Finding implements Serializable {
, "VULNERABILITY"."SEVERITY"
, "VULNERABILITY"."CVSSV2BASESCORE"
, "VULNERABILITY"."CVSSV3BASESCORE"
, "VULNERABILITY"."CVSSV4BASESCORE"
, "VULNERABILITY"."OWASPRRLIKELIHOODSCORE"
, "VULNERABILITY"."OWASPRRTECHNICALIMPACTSCORE"
, "VULNERABILITY"."OWASPRRBUSINESSIMPACTSCORE"
Expand Down Expand Up @@ -195,34 +197,35 @@ public Finding(UUID project, Object... o) {
} else {
optValue(vulnerability, "recommendation", o[13]);
}
final Severity severity = VulnerabilityUtil.getSeverity(o[14], (BigDecimal) o[15], (BigDecimal) o[16], (BigDecimal) o[17], (BigDecimal) o[18], (BigDecimal) o[19]);
final Severity severity = VulnerabilityUtil.getSeverity(o[14], (BigDecimal) o[15], (BigDecimal) o[16], (BigDecimal) o[17], (BigDecimal) o[18], (BigDecimal) o[19], (BigDecimal) o[20]);
optValue(vulnerability, "cvssV2BaseScore", o[15]);
optValue(vulnerability, "cvssV3BaseScore", o[16]);
optValue(vulnerability, "owaspLikelihoodScore", o[17]);
optValue(vulnerability, "owaspTechnicalImpactScore", o[18]);
optValue(vulnerability, "owaspBusinessImpactScore", o[19]);
optValue(vulnerability, "cvssV4BaseScore", o[17]);
optValue(vulnerability, "owaspLikelihoodScore", o[18]);
optValue(vulnerability, "owaspTechnicalImpactScore", o[19]);
optValue(vulnerability, "owaspBusinessImpactScore", o[20]);
optValue(vulnerability, "severity", severity.name());
optValue(vulnerability, "severityRank", severity.ordinal());
optValue(vulnerability, "epssScore", o[20]);
optValue(vulnerability, "epssPercentile", o[21]);
final List<Cwe> cwes = getCwes(o[22]);
optValue(vulnerability, "epssScore", o[21]);
optValue(vulnerability, "epssPercentile", o[22]);
final List<Cwe> cwes = getCwes(o[23]);
if (cwes != null && !cwes.isEmpty()) {
// Ensure backwards-compatibility with DT < 4.5.0. Remove this in v5!
optValue(vulnerability, "cweId", cwes.get(0).getCweId());
optValue(vulnerability, "cweName", cwes.get(0).getName());
optValue(vulnerability, "cweId", cwes.getFirst().getCweId());
optValue(vulnerability, "cweName", cwes.getFirst().getName());
}
optValue(vulnerability, "cwes", cwes);
optValue(attribution, "analyzerIdentity", o[23]);
optValue(attribution, "attributedOn", o[24]);
optValue(attribution, "alternateIdentifier", o[25]);
optValue(attribution, "referenceUrl", o[26]);
optValue(attribution, "analyzerIdentity", o[24]);
optValue(attribution, "attributedOn", o[25]);
optValue(attribution, "alternateIdentifier", o[26]);
optValue(attribution, "referenceUrl", o[27]);

optValue(analysis, "state", o[27]);
optValue(analysis, "isSuppressed", o[28], false);
if (o.length > 30) {
optValue(vulnerability, "published", o[29]);
optValue(component, "projectName", o[31]);
optValue(component, "projectVersion", o[32]);
optValue(analysis, "state", o[28]);
optValue(analysis, "isSuppressed", o[29], false);
if (o.length > 31) {
optValue(vulnerability, "published", o[30]);
optValue(component, "projectName", o[32]);
optValue(component, "projectVersion", o[33]);
}
}

Expand Down
12 changes: 7 additions & 5 deletions src/main/java/org/dependencytrack/model/GroupedFinding.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ public class GroupedFinding implements Serializable {
, "VULNERABILITY"."SEVERITY"
, "VULNERABILITY"."CVSSV2BASESCORE"
, "VULNERABILITY"."CVSSV3BASESCORE"
, "VULNERABILITY"."CVSSV4BASESCORE"
, "VULNERABILITY"."OWASPRRLIKELIHOODSCORE"
, "VULNERABILITY"."OWASPRRTECHNICALIMPACTSCORE"
, "VULNERABILITY"."OWASPRRBUSINESSIMPACTSCORE"
Expand Down Expand Up @@ -77,13 +78,14 @@ public GroupedFinding(Object ...o) {
optValue(vulnerability, "source", o[0]);
optValue(vulnerability, "vulnId", o[1]);
optValue(vulnerability, "title", o[2]);
optValue(vulnerability, "severity", VulnerabilityUtil.getSeverity(o[3], (BigDecimal) o[4], (BigDecimal) o[5], (BigDecimal) o[6], (BigDecimal) o[7], (BigDecimal) o[8]));
optValue(vulnerability, "severity", VulnerabilityUtil.getSeverity(o[3], (BigDecimal) o[4], (BigDecimal) o[5], (BigDecimal) o[6], (BigDecimal) o[7], (BigDecimal) o[8], (BigDecimal) o[9]));
optValue(vulnerability, "cvssV2BaseScore", o[4]);
optValue(vulnerability, "cvssV3BaseScore", o[5]);
optValue(attribution, "analyzerIdentity", o[9]);
optValue(vulnerability, "published", o[10]);
optValue(vulnerability, "cwes", Finding.getCwes(o[11]));
optValue(vulnerability, "affectedProjectCount", o[12]);
optValue(vulnerability, "cvssV4BaseScore", o[6]);
optValue(attribution, "analyzerIdentity", o[10]);
optValue(vulnerability, "published", o[11]);
optValue(vulnerability, "cwes", Finding.getCwes(o[12]));
optValue(vulnerability, "affectedProjectCount", o[13]);
}

public Map<String, Object> getVulnerability() {
Expand Down
69 changes: 69 additions & 0 deletions src/main/java/org/dependencytrack/model/Vulnerability.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -284,6 +284,24 @@ public static Source resolve(String id) {
@Pattern(regexp = RegexSequence.Definition.PRINTABLE_CHARS_PLUS, message = "The CVSSv3 Vector may only contain printable characters")
private String cvssV3Vector;

@Persistent
@Column(name = "CVSSV4BASESCORE", scale = 1)
private BigDecimal cvssV4BaseScore;

@Persistent
@Column(name = "CVSSV4THREATSCORE", scale = 1)
private BigDecimal cvssV4ThreatScore;

@Persistent
@Column(name = "CVSSV4ENVIRONMENTALSCORE", scale = 1)
private BigDecimal cvssV4EnvironmentalScore;

@Persistent
@Column(name = "CVSSV4VECTOR")
@JsonDeserialize(using = TrimmedStringDeserializer.class)
@Pattern(regexp = RegexSequence.Definition.PRINTABLE_CHARS_PLUS, message = "The CVSSv4 Vector may only contain printable characters")
Copy link
Contributor

@snieguu snieguu Oct 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we should do here more strict validation, accept only valid CVSSv4 vectors

Copy link
Contributor Author

@tobiasgies tobiasgies Oct 29, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree in principle, I just copy/pasted the validation code for the other CVSS vector versions for the moment. However I think this might be duplicate work - the org.metaeffekt.core:ae-security package contains stricter validation logic in CvssVector.parseVector. Any invalid vector will cause the method to return null instead of a CvssVector instance, causing the data to be thrown out.

With that in mind, do you still think additional validation is needed in this place?

Copy link
Contributor

@snieguu snieguu Oct 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes I know that for every other places related to CVSS we have PRINTABLE_CHARS_PLUS.
Regarding to

Any invalid vector will cause the method to return null instead of a CvssVector instance, causing the data to be thrown out.

validation in CvssVector.parseVector is also very simple, regex is:

private static final Pattern CVSS_PATTERN = Pattern.compile("CVSS:\\d+\\.?\\d?");

For instance, I am able to create such internal Vulnerability in DependencyTrack 4.13.6(note that i was able to put invalid cvss 4.0 vector into cvss 2.0)
Screenshot 2025-10-30 at 11 54 23

From my experience strict validation should be present from the begining of the feature because then data that normaly will be rejected(because validation) are living in db and can cause a problems

Second thing is that OWASP product should be secure as much as possible, because this is OWASP mission at the end,
how can we teach people to write application according to ASVS 4.X when we not do the same.

On the other hand previous version of cvss was written in a way that is used in PR, making difference here can cause problems that i am not aware of, so I agree with that maybe it can be addressed later(I can do that)

Copy link
Member

@nscuro nscuro Oct 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might make sense to look into creating a custom validator, like we have for cron expressions for example.

I do agree that adding that for existing CVSS types might cause issues that would need proper data migration first. But for everything we add going forward, it makes sense to be more defensive as to what we accept.

private String cvssV4Vector;

@Persistent
@Column(name = "OWASPRRLIKELIHOODSCORE", scale = 1)
private BigDecimal owaspRRLikelihoodScore;
Expand Down Expand Up @@ -643,6 +661,38 @@ public void setCvssV3Vector(String cvssV3Vector) {
this.cvssV3Vector = cvssV3Vector;
}

public BigDecimal getCvssV4BaseScore() {
return cvssV4BaseScore;
}

public void setCvssV4BaseScore(BigDecimal cvssV4BaseScore) {
this.cvssV4BaseScore = cvssV4BaseScore;
}

public BigDecimal getCvssV4ThreatScore() {
return cvssV4ThreatScore;
}

public void setCvssV4ThreatScore(BigDecimal cvssV4ThreatScore) {
this.cvssV4ThreatScore = cvssV4ThreatScore;
}

public BigDecimal getCvssV4EnvironmentalScore() {
return cvssV4EnvironmentalScore;
}

public void setCvssV4EnvironmentalScore(BigDecimal cvssV4EnvironmentalScore) {
this.cvssV4EnvironmentalScore = cvssV4EnvironmentalScore;
}

public String getCvssV4Vector() {
return cvssV4Vector;
}

public void setCvssV4Vector(String cvssV4Vector) {
this.cvssV4Vector = cvssV4Vector;
}

public BigDecimal getEpssScore() {
return epssScore;
}
Expand Down Expand Up @@ -791,6 +841,25 @@ public void applyV3Score(CvssVector cvss) {
setCvssV3Vector(cvss.toString());
}

public void applyV4Score(CvssVector cvss) {
Objects.requireNonNull(cvss, "CVSS vector cannot be null");

final var score = cvss.getBakedScores();
setCvssV4BaseScore(BigDecimal.valueOf(score.getBaseScore()));

final var threatScore = score.getThreatScore();
if (!Double.isNaN(threatScore)) {
setCvssV4ThreatScore(BigDecimal.valueOf(threatScore));
}

final var envScore = score.getEnvironmentalScore();
if (!Double.isNaN(envScore)) {
setCvssV4EnvironmentalScore(BigDecimal.valueOf(envScore));
}

setCvssV4Vector(cvss.toString());
}

@Override
public String toString() {
return "Vulnerability(sourde=%s, vulnId=%s)".formatted(getSource(), getVulnId());
Expand Down
33 changes: 23 additions & 10 deletions src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -834,6 +834,18 @@ public static Service convert(final QueryManager qm, final ServiceComponent serv
return cycloneService;
}

private static org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity convertCvss3Or4ScoretoCdxSeverity(double score) {
if (score >= 9.0) {
return org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity.CRITICAL;
} else if (score >= 7.0) {
return org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity.HIGH;
} else if (score >= 4.0) {
return org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity.MEDIUM;
} else {
return org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity.LOW;
}
}

public static org.cyclonedx.model.vulnerability.Vulnerability convert(final QueryManager qm, final CycloneDXExporter.Variant variant,
final Finding finding) {
final Component component = qm.getObjectByUuid(Component.class, (String)finding.getComponent().get("uuid"));
Expand Down Expand Up @@ -872,15 +884,16 @@ public static org.cyclonedx.model.vulnerability.Vulnerability convert(final Quer
}
rating.setScore(vulnerability.getCvssV3BaseScore().doubleValue());
rating.setVector(vulnerability.getCvssV3Vector());
if (rating.getScore() >= 9.0) {
rating.setSeverity(org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity.CRITICAL);
} else if (rating.getScore() >= 7.0) {
rating.setSeverity(org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity.HIGH);
} else if (rating.getScore() >= 4.0) {
rating.setSeverity(org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity.MEDIUM);
} else {
rating.setSeverity(org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity.LOW);
}
rating.setSeverity(ModelConverter.convertCvss3Or4ScoretoCdxSeverity(rating.getScore()));
cdxVulnerability.addRating(rating);
}
if (vulnerability.getCvssV4BaseScore() != null) {
org.cyclonedx.model.vulnerability.Vulnerability.Rating rating = new org.cyclonedx.model.vulnerability.Vulnerability.Rating();
rating.setSource(convertDtVulnSourceToCdxVulnSource(Vulnerability.Source.valueOf(vulnerability.getSource())));
rating.setMethod(org.cyclonedx.model.vulnerability.Vulnerability.Rating.Method.CVSSV4);
rating.setScore(vulnerability.getCvssV4BaseScore().doubleValue());
rating.setVector(vulnerability.getCvssV4Vector());
rating.setSeverity(ModelConverter.convertCvss3Or4ScoretoCdxSeverity(rating.getScore()));
cdxVulnerability.addRating(rating);
}
if (vulnerability.getOwaspRRLikelihoodScore() != null && vulnerability.getOwaspRRTechnicalImpactScore() != null && vulnerability.getOwaspRRBusinessImpactScore() != null) {
Expand All @@ -891,7 +904,7 @@ public static org.cyclonedx.model.vulnerability.Vulnerability convert(final Quer
rating.setVector(vulnerability.getOwaspRRVector());
cdxVulnerability.addRating(rating);
}
if (vulnerability.getCvssV2BaseScore() == null && vulnerability.getCvssV3BaseScore() == null && vulnerability.getOwaspRRLikelihoodScore() == null) {
if (vulnerability.getCvssV2BaseScore() == null && vulnerability.getCvssV3BaseScore() == null && vulnerability.getCvssV4BaseScore() == null && vulnerability.getOwaspRRLikelihoodScore() == null) {
org.cyclonedx.model.vulnerability.Vulnerability.Rating rating = new org.cyclonedx.model.vulnerability.Vulnerability.Rating();
rating.setSeverity(convertDtSeverityToCdxSeverity(vulnerability.getSeverity()));
rating.setSource(convertDtVulnSourceToCdxVulnSource(Vulnerability.Source.valueOf(vulnerability.getSource())));
Expand Down
11 changes: 8 additions & 3 deletions src/main/java/org/dependencytrack/parser/github/ModelConverter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,14 +88,19 @@
vuln.applyV3Score(parsedCvssV3);
}
}

// TODO: advisory.getCvssSeverities().getCvssV4()
// Requires CVSSv4 support in the DT data model.
final var cvssv4 = advisory.getCvssSeverities().getCvssV4();
if (cvssv4 != null) {
final var parsedCvssV4 = CvssUtil.parse(cvssv4.getVectorString());
if (parsedCvssV4 != null) {

Check notice on line 94 in src/main/java/org/dependencytrack/parser/github/ModelConverter.java

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

src/main/java/org/dependencytrack/parser/github/ModelConverter.java#L94 

Deeply nested if..then statements are hard to read
vuln.applyV4Score(parsedCvssV4);
}
}

vuln.setSeverity(VulnerabilityUtil.getSeverity(
vuln.getSeverity(),
vuln.getCvssV2BaseScore(),
vuln.getCvssV3BaseScore(),
vuln.getCvssV4BaseScore(),
vuln.getOwaspRRLikelihoodScore(),
vuln.getOwaspRRTechnicalImpactScore(),
vuln.getOwaspRRBusinessImpactScore()));
Expand Down
24 changes: 24 additions & 0 deletions src/main/java/org/dependencytrack/parser/nvd/api20/ModelConverter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
import io.github.jeremylong.openvulnerability.client.nvd.CveItem;
import io.github.jeremylong.openvulnerability.client.nvd.CvssV2;
import io.github.jeremylong.openvulnerability.client.nvd.CvssV3;
import io.github.jeremylong.openvulnerability.client.nvd.CvssV4;
import io.github.jeremylong.openvulnerability.client.nvd.LangString;
import io.github.jeremylong.openvulnerability.client.nvd.Metrics;
import io.github.jeremylong.openvulnerability.client.nvd.Node;
Expand Down Expand Up @@ -169,9 +170,32 @@ private static void convertCvssMetrics(final Metrics metrics, final Vulnerabilit
}
}

if (metrics.getCvssMetricV40() != null && !metrics.getCvssMetricV40().isEmpty()) {
metrics.getCvssMetricV40().sort(comparingInt(metric -> metric.getType().ordinal()));

for (final CvssV4 metric : metrics.getCvssMetricV40()) {
final var cvss = CvssUtil.parse(metric.getCvssData().getVectorString());
vuln.setCvssV4Vector(cvss.toString());
vuln.setCvssV4BaseScore(BigDecimal.valueOf(metric.getCvssData().getBaseScore()));

final Double envScore = metric.getCvssData().getEnvironmentalScore();
if (envScore != null && !envScore.isNaN()) {
vuln.setCvssV4EnvironmentalScore(BigDecimal.valueOf(envScore));
}

final Double threatScore = metric.getCvssData().getThreatScore();
if (threatScore != null && !threatScore.isNaN()) {
vuln.setCvssV4ThreatScore(BigDecimal.valueOf(threatScore));
}

break;
}
}

vuln.setSeverity(VulnerabilityUtil.getSeverity(
vuln.getCvssV2BaseScore(),
vuln.getCvssV3BaseScore(),
vuln.getCvssV4BaseScore(),
vuln.getOwaspRRLikelihoodScore(),
vuln.getOwaspRRTechnicalImpactScore(),
vuln.getOwaspRRBusinessImpactScore()
Expand Down
3 changes: 3 additions & 0 deletions src/main/java/org/dependencytrack/parser/osv/OsvAdvisoryParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,9 @@
final JSONObject cvss = cvssList.getJSONObject(i);
final String type = cvss.optString("type", null);
if (type == null) continue;
if (type.equalsIgnoreCase("CVSS_V4")) {

Check notice on line 99 in src/main/java/org/dependencytrack/parser/osv/OsvAdvisoryParser.java

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

src/main/java/org/dependencytrack/parser/osv/OsvAdvisoryParser.java#L99 

Deeply nested if..then statements are hard to read
advisory.setCvssV4Vector(cvss.optString("score", null));
}
if (type.equalsIgnoreCase("CVSS_V3")) {
advisory.setCvssV3Vector(cvss.optString("score", null));
}
Expand Down
10 changes: 10 additions & 0 deletions src/main/java/org/dependencytrack/parser/osv/model/OsvAdvisory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,8 @@ public class OsvAdvisory {

private String cvssV3Vector;

private String cvssV4Vector;

public String getId() {
return id;
}
Expand Down Expand Up @@ -187,6 +189,14 @@ public void setCvssV3Vector(String cvssV3Vector) {
this.cvssV3Vector = cvssV3Vector;
}

public String getCvssV4Vector() {
return cvssV4Vector;
}

public void setCvssV4Vector(String cvssV4Vector) {
this.cvssV4Vector = cvssV4Vector;
}

public List<String> getCredits() {
return credits;
}
Expand Down
4 changes: 4 additions & 0 deletions src/main/java/org/dependencytrack/parser/trivy/TrivyParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,12 +82,16 @@ public Vulnerability setCvssScore(CVSS cvss, Vulnerability vulnerability) {
if (cvss != null) {
vulnerability.setCvssV2Vector(trimToNull(cvss.getV2Vector()));
vulnerability.setCvssV3Vector(trimToNull(cvss.getV3Vector()));
vulnerability.setCvssV4Vector(trimToNull(cvss.getV40Vector()));
if (cvss.getV2Score() > 0.0) {
vulnerability.setCvssV2BaseScore(BigDecimal.valueOf(cvss.getV2Score()));
}
if (cvss.getV3Score() > 0.0) {
vulnerability.setCvssV3BaseScore(BigDecimal.valueOf(cvss.getV3Score()));
}
if (cvss.getV40Score() > 0.0) {
vulnerability.setCvssV4BaseScore(BigDecimal.valueOf(cvss.getV40Score()));
}
}

return vulnerability;
Expand Down
4 changes: 4 additions & 0 deletions src/main/java/org/dependencytrack/parser/vulndb/ModelConverter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,9 +158,13 @@ public static Vulnerability convert(final QueryManager qm, final org.dependencyt
break; // Always prefer use of the NVD scoring, if available
}
}

// TODO it doesn't look like VulnDB provides CVSSv4 metics yet.

vuln.setSeverity(VulnerabilityUtil.getSeverity(
vuln.getCvssV2BaseScore(),
vuln.getCvssV3BaseScore(),
vuln.getCvssV4BaseScore(),
vuln.getOwaspRRLikelihoodScore(),
vuln.getOwaspRRTechnicalImpactScore(),
vuln.getOwaspRRBusinessImpactScore()
Expand Down
Loading
Loading