Skip to content

Commit 91ffcf6

Browse files
aikebahaikebah
authored
fix: Use unscored severity only in absence of any CVSS baseScore (#7530)
1 parent 0ce5ea8 commit 91ffcf6

File tree

4 files changed

+45
-21
lines changed

4 files changed

+45
-21
lines changed

‎ant/src/main/java/org/owasp/dependencycheck/taskdefs/Check.java‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1524,12 +1524,23 @@ private void checkForFailure(Dependency[] dependencies) throws BuildException {
15241524
for (Dependency d : dependencies) {
15251525
boolean addName = true;
15261526
for (Vulnerability v : d.getVulnerabilities()) {
1527-
if ((v.getCvssV2() != null && v.getCvssV2().getCvssData().getBaseScore() >= failBuildOnCVSS)
1528-
|| (v.getCvssV3() != null && v.getCvssV3().getCvssData().getBaseScore() >= failBuildOnCVSS)
1529-
|| (v.getCvssV4() != null && v.getCvssV4().getCvssData().getBaseScore() >= failBuildOnCVSS)
1530-
|| (v.getUnscoredSeverity() != null && SeverityUtil.estimateCvssV2(v.getUnscoredSeverity()) >= failBuildOnCVSS)
1527+
final double cvssV2 = v.getCvssV2() != null && v.getCvssV2().getCvssData() != null
1528+
&& v.getCvssV2().getCvssData().getBaseScore() != null ? v.getCvssV2().getCvssData().getBaseScore() : -1;
1529+
final double cvssV3 = v.getCvssV3() != null && v.getCvssV3().getCvssData() != null
1530+
&& v.getCvssV3().getCvssData().getBaseScore() != null ? v.getCvssV3().getCvssData().getBaseScore() : -1;
1531+
final double cvssV4 = v.getCvssV4() != null && v.getCvssV4().getCvssData() != null
1532+
&& v.getCvssV4().getCvssData().getBaseScore() != null ? v.getCvssV4().getCvssData().getBaseScore() : -1;
1533+
final boolean useUnscored = cvssV2 == -1 && cvssV3 == -1 && cvssV4 == -1;
1534+
final double unscoredCvss =
1535+
useUnscored && v.getUnscoredSeverity() != null ? SeverityUtil.estimateCvssV2(v.getUnscoredSeverity()) : -1;
1536+
1537+
if (cvssV2 >= failBuildOnCVSS
1538+
|| cvssV3 >= failBuildOnCVSS
1539+
|| cvssV4 >= failBuildOnCVSS
1540+
|| unscoredCvss >= failBuildOnCVSS
15311541
//safety net to fail on any if for some reason the above misses on 0
1532-
|| (failBuildOnCVSS <= 0.0f)) {
1542+
|| failBuildOnCVSS <= 0.0f
1543+
) {
15331544
if (addName) {
15341545
addName = false;
15351546
ids.append(NEW_LINE).append(d.getFileName()).append(" (")

‎cli/src/main/java/org/owasp/dependencycheck/App.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -313,13 +313,14 @@ private int determineReturnCode(Engine engine, float cvssFailScore) {
313313
for (Dependency d : engine.getDependencies()) {
314314
boolean addName = true;
315315
for (Vulnerability v : d.getVulnerabilities()) {
316-
final Double cvssV2 = v.getCvssV2() != null && v.getCvssV2().getCvssData() != null
316+
final double cvssV2 = v.getCvssV2() != null && v.getCvssV2().getCvssData() != null
317317
&& v.getCvssV2().getCvssData().getBaseScore() != null ? v.getCvssV2().getCvssData().getBaseScore() : -1;
318-
final Double cvssV3 = v.getCvssV3() != null && v.getCvssV3().getCvssData() != null
318+
final double cvssV3 = v.getCvssV3() != null && v.getCvssV3().getCvssData() != null
319319
&& v.getCvssV3().getCvssData().getBaseScore() != null ? v.getCvssV3().getCvssData().getBaseScore() : -1;
320-
final Double cvssV4 = v.getCvssV4() != null && v.getCvssV4().getCvssData() != null
320+
final double cvssV4 = v.getCvssV4() != null && v.getCvssV4().getCvssData() != null
321321
&& v.getCvssV4().getCvssData().getBaseScore() != null ? v.getCvssV4().getCvssData().getBaseScore() : -1;
322-
final Double unscoredCvss = v.getUnscoredSeverity() != null ? SeverityUtil.estimateCvssV2(v.getUnscoredSeverity()) : -1;
322+
final boolean useUnscored = cvssV2 == -1 && cvssV3 == -1 && cvssV4 == -1;
323+
final double unscoredCvss = (useUnscored && v.getUnscoredSeverity() != null) ? SeverityUtil.estimateCvssV2(v.getUnscoredSeverity()) : -1;
323324

324325
if (cvssV2 >= cvssFailScore
325326
|| cvssV3 >= cvssFailScore

‎core/src/main/java/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1027,12 +1027,21 @@ private void checkForFailure(Dependency[] dependencies) throws ScanAgentExceptio
10271027
for (Dependency d : dependencies) {
10281028
boolean addName = true;
10291029
for (Vulnerability v : d.getVulnerabilities()) {
1030-
if ((v.getCvssV2() != null && v.getCvssV2().getCvssData().getBaseScore() >= failBuildOnCVSS)
1031-
|| (v.getCvssV3() != null && v.getCvssV3().getCvssData().getBaseScore() >= failBuildOnCVSS)
1032-
|| (v.getCvssV4() != null && v.getCvssV4().getCvssData().getBaseScore() >= failBuildOnCVSS)
1033-
|| (v.getUnscoredSeverity() != null && SeverityUtil.estimateCvssV2(v.getUnscoredSeverity()) >= failBuildOnCVSS)
1030+
final double cvssV2 = v.getCvssV2() != null && v.getCvssV2().getCvssData() != null
1031+
&& v.getCvssV2().getCvssData().getBaseScore() != null ? v.getCvssV2().getCvssData().getBaseScore() : -1;
1032+
final double cvssV3 = v.getCvssV3() != null && v.getCvssV3().getCvssData() != null
1033+
&& v.getCvssV3().getCvssData().getBaseScore() != null ? v.getCvssV3().getCvssData().getBaseScore() : -1;
1034+
final double cvssV4 = v.getCvssV4() != null && v.getCvssV4().getCvssData() != null
1035+
&& v.getCvssV4().getCvssData().getBaseScore() != null ? v.getCvssV4().getCvssData().getBaseScore() : -1;
1036+
final boolean useUnscored = cvssV2 == -1 && cvssV3 == -1 && cvssV4 == -1;
1037+
final double unscoredCvss = (useUnscored && v.getUnscoredSeverity() != null) ? SeverityUtil.estimateCvssV2(v.getUnscoredSeverity()) : -1;
1038+
if (cvssV2 >= failBuildOnCVSS
1039+
|| cvssV3 >= failBuildOnCVSS
1040+
|| cvssV4 >= failBuildOnCVSS
1041+
|| unscoredCvss >= failBuildOnCVSS
10341042
//safety net to fail on any if for some reason the above misses on 0
1035-
|| (failBuildOnCVSS <= 0.0f)) {
1043+
|| failBuildOnCVSS <= 0.0f
1044+
) {
10361045
if (addName) {
10371046
addName = false;
10381047
ids.append(NEW_LINE).append(d.getFileName()).append(" (")

‎maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2838,17 +2838,20 @@ protected void checkForFailure(Dependency[] dependencies) throws MojoFailureExce
28382838
for (Dependency d : dependencies) {
28392839
boolean addName = true;
28402840
for (Vulnerability v : d.getVulnerabilities()) {
2841-
final Double cvssV2 = v.getCvssV2() != null && v.getCvssV2().getCvssData() != null && v.getCvssV2().getCvssData().getBaseScore() != null ? v.getCvssV2().getCvssData().getBaseScore() : -1;
2842-
final Double cvssV3 = v.getCvssV3() != null && v.getCvssV3().getCvssData() != null && v.getCvssV3().getCvssData().getBaseScore() != null ? v.getCvssV3().getCvssData().getBaseScore() : -1;
2843-
final Double cvssV4 = v.getCvssV4() != null && v.getCvssV4().getCvssData() != null && v.getCvssV4().getCvssData().getBaseScore() != null ? v.getCvssV4().getCvssData().getBaseScore() : -1;
2844-
final Double unscoredCvss = v.getUnscoredSeverity() != null ? SeverityUtil.estimateCvssV2(v.getUnscoredSeverity()) : -1;
2845-
2846-
if (failBuildOnAnyVulnerability || cvssV2 >= failBuildOnCVSS
2841+
final double cvssV2 = v.getCvssV2() != null && v.getCvssV2().getCvssData() != null && v.getCvssV2().getCvssData().getBaseScore() != null ? v.getCvssV2().getCvssData().getBaseScore() : -1;
2842+
final double cvssV3 = v.getCvssV3() != null && v.getCvssV3().getCvssData() != null && v.getCvssV3().getCvssData().getBaseScore() != null ? v.getCvssV3().getCvssData().getBaseScore() : -1;
2843+
final double cvssV4 = v.getCvssV4() != null && v.getCvssV4().getCvssData() != null && v.getCvssV4().getCvssData().getBaseScore() != null ? v.getCvssV4().getCvssData().getBaseScore() : -1;
2844+
final boolean useUnscored = cvssV2 == -1 && cvssV3 == -1 && cvssV4 == -1;
2845+
final double unscoredCvss = (useUnscored && v.getUnscoredSeverity() != null) ? SeverityUtil.estimateCvssV2(v.getUnscoredSeverity()) : -1;
2846+
2847+
if (failBuildOnAnyVulnerability
2848+
|| cvssV2 >= failBuildOnCVSS
28472849
|| cvssV3 >= failBuildOnCVSS
28482850
|| cvssV4 >= failBuildOnCVSS
28492851
|| unscoredCvss >= failBuildOnCVSS
28502852
//safety net to fail on any if for some reason the above misses on 0
2851-
|| (failBuildOnCVSS <= 0.0)) {
2853+
|| failBuildOnCVSS <= 0.0
2854+
) {
28522855
String name = v.getName();
28532856
if (cvssV4 >= 0.0) {
28542857
name += "(" + cvssV4 + ")";

0 commit comments

Comments
 (0)