-
Notifications
You must be signed in to change notification settings - Fork 50
SSVC #871
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
tschmidtb51
merged 27 commits into
oasis-tcs:editor-revision-2025-02-26
from
tschmidtb51:ssvc
Mar 4, 2025
Merged
SSVC #871
Changes from all commits
Commits
Show all changes
27 commits
Select commit
Hold shift + click to select a range
68e5ca0
SSVC
tschmidtb51 4eecfc2
SSVC
tschmidtb51 a38b394
SSVC
tschmidtb51 789785c
SSVC
tschmidtb51 599b150
SSVC
tschmidtb51 7ac9c47
SSVC
tschmidtb51 c6889a5
Merge remote-tracking branch 'upstream/editor-revision-2025-02-26' in…
tschmidtb51 4d23886
SSVC
tschmidtb51 4946309
SSVC
tschmidtb51 9762db1
SSVC
tschmidtb51 1ec5b95
SSVC
tschmidtb51 07cfab1
SSVC
tschmidtb51 cd9aabf
SSVC
tschmidtb51 52f5d9b
SSVC
tschmidtb51 1136122
SSVC
tschmidtb51 95cc120
SSVC
tschmidtb51 946d25e
SSVC
tschmidtb51 7291d49
SSVC
tschmidtb51 e7f49c8
SSVC
tschmidtb51 674e64d
SSVC
tschmidtb51 23518a7
Nit: Distribution of a sentence across two lines.
sthagen 85aefd8
SSVC
tschmidtb51 f7fbb1f
Merge remote-tracking branch 'upstream/editor-revision-2025-02-26' in…
tschmidtb51 4a421c3
SSVC
tschmidtb51 3d3ad6e
SSVC
tschmidtb51 789e037
SSVC
tschmidtb51 8e19dc4
SSVC
tschmidtb51 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| ### Invalid SSVC | ||
|
|
||
| It MUST be tested that the given SSVC object is valid according to the referenced schema. | ||
|
|
||
| The relevant path for this test is: | ||
|
|
||
| ``` | ||
| /vulnerabilities[]/metrics[]/content/ssvc_v1 | ||
| ``` | ||
|
|
||
| *Example 1 (which fails the test):* | ||
|
|
||
| ``` | ||
| "ssvc_v1": { | ||
| "id": "CVE-1900-0001", | ||
| "schemaVersion": "1-0-1", | ||
| "timestamp": "2024-01-24T10:00:00.000Z" | ||
| } | ||
| ``` | ||
|
|
||
| > The required element `selections` is missing. | ||
| > A tool MAY add the missing property `id` based on the values given in `cve` respectively `ids[]/text` as quick fix. |
44 changes: 44 additions & 0 deletions
44
csaf_2.1/prose/edit/src/tests-01-mndtr-47-inconsistent-ssvc-id.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| ### Inconsistent SSVC ID | ||
|
|
||
| For each `ssvc_v1` object it MUST be tested that `id` is either the CVE of the vulnerability given in `cve` or the `text` of an item in the `ids` array. | ||
| The test MUST fail, if the `id` equals the `/document/tracking/id` and the CSAF document contains more than one vulnerability. | ||
|
|
||
| The relevant path for this test is: | ||
|
|
||
| ``` | ||
| /vulnerabilities[]/metrics[]/content/ssvc_v1/id | ||
| ``` | ||
|
|
||
| *Example 1 (which fails the test):* | ||
|
|
||
| ``` | ||
| "vulnerabilities": [ | ||
| { | ||
| "cve": "CVE-1900-0001", | ||
| "metrics": [ | ||
| { | ||
| "content": { | ||
| "ssvc_v1": { | ||
| "id": "CVE-1900-0002", | ||
| "schemaVersion": "1-0-1", | ||
| "selections": [ | ||
| { | ||
| "name": "Exploitation", | ||
| "namespace": "ssvc", | ||
| "values": [ | ||
| "None" | ||
| ], | ||
| "version": "1.1.0" | ||
| } | ||
| ], | ||
| "timestamp": "2024-01-24T10:00:00.000Z" | ||
| } | ||
| }, | ||
| // ... | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| > The SSVC ID does not match the CVE ID. |
57 changes: 57 additions & 0 deletions
57
csaf_2.1/prose/edit/src/tests-01-mndtr-48-ssvc-decision-points.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| ### SSVC Decision Points | ||
|
|
||
| For each SSVC decision point given under `selections` with a registered `namespace`, it MUST be tested that given decision point exists, is valid and the items in `values` are ordered correctly. | ||
|
|
||
| > According to the SSVC project, the following values are currently registered: | ||
| > | ||
| > ``` | ||
| > cvss | ||
| > nciss | ||
| > ssvc | ||
| > ``` | ||
| > | ||
| > A list of all valid decision points including their values is available at the [SSVC repository](https://github.com/CERTCC/SSVC/tree/main/data/json/decision_points). | ||
| > The items in `values` need to have the same order as in their definition. | ||
|
|
||
| The relevant path for this test is: | ||
|
|
||
| ``` | ||
| /vulnerabilities[]/metrics[]/content/ssvc_v1/selections[] | ||
| ``` | ||
|
|
||
| *Example 1 (which fails the test):* | ||
|
|
||
| ``` | ||
| "vulnerabilities": [ | ||
| { | ||
| "cve": "CVE-1900-0001", | ||
| "metrics": [ | ||
| { | ||
| "content": { | ||
| "ssvc_v1": { | ||
| "id": "CVE-1900-0001", | ||
| "schemaVersion": "1-0-1", | ||
| "selections": [ | ||
| { | ||
| "name": "Mission Impact", | ||
| "namespace": "ssvc", | ||
| "values": [ | ||
| "None", | ||
| "Degraded" | ||
| ], | ||
| "version": "1.0.0" | ||
| } | ||
| ], | ||
| "timestamp": "2024-01-24T10:00:00.000Z" | ||
| } | ||
| }, | ||
| // ... | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| > The SSVC decision point `Mission Impact` doesn't have the value `Degraded` in version `1.0.0`. | ||
|
|
||
| > If applicable, a tool MAY sort the items in `values` according to the order of their definition as a quick fix. |
66 changes: 66 additions & 0 deletions
66
csaf_2.1/prose/edit/src/tests-01-mndtr-49-inconsistent-ssvc-timestamp.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| ### Inconsistent SSVC Timestamp | ||
|
|
||
| For each vulnerability, it MUST be tested that the SSVC `timestamp` is earlier or equal to the `date` of the newest item of the `revision_history` | ||
| if the document status is `final` or `interim`. | ||
| As the timestamps might use different timezones, the sorting MUST take timezones into account. | ||
|
|
||
| The relevant path for this test is: | ||
|
|
||
| ``` | ||
| /vulnerabilities[]/metrics[]/content/ssvc_v1/timestamp | ||
| ``` | ||
|
|
||
| *Example 1 (which fails the test):* | ||
|
|
||
| ``` | ||
| "document": { | ||
| // ... | ||
| "distribution": { | ||
| "tlp": { | ||
| "label": "CLEAR" | ||
| } | ||
| }, | ||
| // ... | ||
| "tracking": { | ||
| // ... | ||
| "revision_history": [ | ||
| { | ||
| "date": "2024-01-24T10:00:00.000Z", | ||
| "number": "1", | ||
| "summary": "Initial version." | ||
| } | ||
| ], | ||
| "status": "final", | ||
| // ... | ||
| } | ||
| }, | ||
| "vulnerabilities": [ | ||
| { | ||
| "cve": "CVE-1900-0001", | ||
| "metrics": [ | ||
| { | ||
| "content": { | ||
| "ssvc_v1": { | ||
| "id": "CVE-1900-0001", | ||
| "schemaVersion": "1-0-1", | ||
| "selections": [ | ||
| { | ||
| "name": "Exploitation", | ||
| "namespace": "ssvc", | ||
| "values": [ | ||
| "Active" | ||
| ], | ||
| "version": "1.1.0" | ||
| } | ||
| ], | ||
| "timestamp": "2024-07-13T10:00:00.000Z" | ||
| } | ||
| }, | ||
| // ... | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| > The document is in status `final` but the SSVC `timestamp` is newer than the `date` of newest item in the `revision_history`. |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.