Repository navigation
Conversation
…ution Previously, CVE conversion in vulnfeeds selected only a single highest-precedence CVSS vector per record (dropping CVSS v3 whenever CVSS v4 was present, and dropping competing NVD or CNA assessments for the same CVSS version) and discarded provenance, leaving `severity[].source` unset even though the OSV schema and downstream services already support multiple severities and source attribution. Update NVD, CVE 5.0, and combined OSV conversion to retain one severity entry per `(CVSS version, source)` pair across CVSS v4 and CVSS v3 and populate `severity[].source`: - Attribute NVD assessments (`nvd@nist.gov`) to `NVD` and CNA assessments (`containers.cna` in CVE 5.0 or metrics matching `cve.sourceIdentifier` in NVD) to `CNA`, preferring Primary metrics and CVSS 3.1 over 3.0 within each `(version, source)` pair. - Because the OSV `Severity.Source` enum only defines `NVD`, `CNA`, and `SELF`, include ADP and other third-party metrics with `source` omitted (`SOURCE_UNSPECIFIED`) only as a fallback when neither `NVD` nor `CNA` provides a score for that CVSS version. - Merge severities across CVE 5.0 and NVD records in `combine-to-osv` instead of ignoring NVD severities, deduplicating by `(Type, Source)` and replacing unattributed ADP fallbacks when an attributed `NVD` or `CNA` score exists for that CVSS version.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Previously, CVE conversion across
vulnfeedsselected only a single highest-precedence CVSS vector per record (dropping CVSS v3 whenever CVSS v4 was present, and dropping competing NVD or CNA assessments for the same CVSS version) and discarded provenance, leavingseverity[].sourceunset. However, the OSV schema (vulnerability.proto,schema.json), Go protobuf bindings (github.com/ossf/osv-schema/bindings/go/osvschema), storage backends (GCS protos, Datastore, PostgreSQL), public API, and website already fully support multiple severity entries and source attribution (osvschema.Severity_Source).This PR updates NVD, CVE 5.0, and combined OSV conversion in
vulnfeedsto retain one severity entry per(CVSS version, source)pair across CVSS v4 and CVSS v3 and populateseverity[].source.Key Changes
1. NVD Conversion (
vulnfeeds/vulns)(CVSS version, source)pair acrossCVSS_V4andCVSS_V3, preferring"Primary"metrics and CVSS 3.1 over 3.0 within each(version, source)bucket.severity.source:"nvd@nist.gov"are attributed toNVD(osvschema.Severity_NVD).cve.sourceIdentifier(the CNA identifier) are attributed toCNA(osvschema.Severity_CNA).SourceIdentifiertoVulnerabilityMetadataandlightNVDItem(LoadTargetCVEMetadata) so lightweight loaders (e.g., Debian and Alpine converters) can accurately attribute CNA scores when parsing NVD metrics.2. CVE 5.0 Conversion (
vulnfeeds/conversion/cve5,vulnfeeds/vulns)containers.cna.metricsand attributed them toCNA(osvschema.Severity_CNA).3. ADP / Third-Party Fallback
Severity.Sourceenum only definesNVD,CNA, andSELF(no enum value exists for ADP or arbitrary third parties), ADP and non-CNA third-party metrics (containers.adpin CVE 5.0 or non-NVD/non-CNA metrics in NVD like CISA-ADP) are retained withsourceomitted (osvschema.Severity_SOURCE_UNSPECIFIED) only as a fallback when neitherNVDnorCNAprovides a score for that CVSS version.NVDorCNAalready provides a score for that CVSS version, third-party fallback metrics for that version are omitted to avoid emitting redundant unattributed scores.4. Combined CVE 5.0 + NVD Pipeline (
vulnfeeds/cmd/combine-to-osv)combineTwoOSVRecordskept only the CVE 5.0 record's severity and ignored NVD severities entirely.vulns.MergeSeverities, deduplicating by(Type, Source)and replacing any unattributedSOURCE_UNSPECIFIEDfallback for a CVSS version if an attributedNVDorCNAassessment exists.CVSS_V4beforeCVSS_V3, andNVDbeforeCNAbeforeSELFbeforeSOURCE_UNSPECIFIED.