Display the CVSS in suggestion data #290

New issue

Closed

opened 2024-10-28 09:37:39 +00:00 by fricklerhandwerk · 4 comments

fricklerhandwerk commented

2024-10-28 09:37:39 +00:00

(Migrated from github.com)

As a security team member, I want to assess the severity of a CVE at a glance, and be able to inspect it in more detail.

Depends on:

https://github.com/Nix-Security-WG/nix-security-tracker/issues/330

As a security team member, I want to assess the severity of a CVE at a glance, and be able to inspect it in more detail. Depends on: - https://github.com/Nix-Security-WG/nix-security-tracker/issues/330

erictapen commented

2024-11-15 15:20:48 +00:00

(Migrated from github.com)

@fricklerhandwerk and I did a rough sketch for it. The base score is shown next to the CVE id in the upper left hand corner. By clicking on it it unfolds into a table that displays the different components of the vector, including links to the documentation of the individual fields. For now we just screenshotted the explanations from nvd.nist.gov.

![desktop](https://github.com/user-attachments/assets/682204e9-e1d0-4e5e-8cc5-7967b1934e77) @fricklerhandwerk and I did a rough sketch for it. The base score is shown next to the CVE id in the upper left hand corner. By clicking on it it unfolds into a table that displays the different components of the vector, including links to the documentation of the individual fields. For now we just screenshotted the explanations from [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2022-47597).

erictapen commented

2024-11-20 15:19:29 +00:00

(Migrated from github.com)

What is this blocked by again?

fricklerhandwerk commented

2024-11-20 15:34:37 +00:00

(Migrated from github.com)

@erictapen #330 -- there are some kinks in the data model. That we're missing out on 1/3 of available metadata because we're not parsing unparsed CVSS is not a hard blocker.

But that doesn't preclude building up the UI, it just precludes delivering the feature.

@erictapen #330 -- there are some kinks in the data model. That we're missing out on 1/3 of available metadata because we're not parsing unparsed CVSS is not a hard blocker. But that doesn't preclude building up the UI, it just precludes delivering the feature.

👍 1

fricklerhandwerk commented

2024-12-05 10:43:51 +00:00

(Migrated from github.com)

Closed by https://github.com/Nix-Security-WG/nix-security-tracker/pull/413