Extract severity from the `metrics` JSON object #112

New issue

Closed

opened 2023-12-11 19:35:16 +00:00 by fricklerhandwerk · 1 comment

fricklerhandwerk commented

2023-12-11 19:35:16 +00:00

(Migrated from github.com)

Required for https://github.com/Nix-Security-WG/nix-local-security-scanner/issues/51

In CVEs the data could look something like this:

            "metrics": [
                {
                    "other": {
                        "content": {
                            "text": "low"
                        },
                        "type": "Textual description of severity"
                    }
                },
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
                        "baseScore": 6.4,
                        "baseSeverity": "MEDIUM"
                    }
                }
            ],

but at the time of writing our data model for that is

class Metric(models.Model):
    """Class representing an impact information related to a CVE record."""

    format = models.CharField(max_length=64)
    scenarios = models.ManyToManyField(Description)
    content = models.JSONField()


class Container(models.Model):
    # ...
    metrics = models.ManyToManyField(Metric)

Required for https://github.com/Nix-Security-WG/nix-local-security-scanner/issues/51 In CVEs the data could look something like this: ```json "metrics": [ { "other": { "content": { "text": "low" }, "type": "Textual description of severity" } }, { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM" } } ], ``` but at the time of writing our data model for that is ```python class Metric(models.Model): """Class representing an impact information related to a CVE record.""" format = models.CharField(max_length=64) scenarios = models.ManyToManyField(Description) content = models.JSONField() class Container(models.Model): # ... metrics = models.ManyToManyField(Metric) ```

RaitoBezarius commented

2024-10-04 20:43:09 +00:00

(Migrated from github.com)

This will be implemented as a data migration and a modification to the CVE ingester to parse immediately metrics further.