Failed to parse the cvss3 score in the securityhub

[stonezdj]

Current Harbor uses the nvd cvss3 score as the CVE score, but sometimes only redhat score is returned.

Original

{
  "CVSS": {
    "nvd": {
      "V2Score": 7.5,
      "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
      "V3Score": 9.8,
      "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "redhat": {
      "V3Score": 3.7,
      "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
    }
  }
}

Sometimes only redhat returned.

{
  "CVSS": {
    "redhat": {
      "V3Score": 6.5,
      "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
    }
  }
}

Need to change the following code

harbor/src/pkg/scan/postprocessors/report_converters.go

Lines 357 to 378 in b38de22

	// CVSS ...
	type CVSS struct {
	NVD Nvd `json:"nvd"`
	}
	// Nvd ...
	type Nvd struct {
	V3Score float64 `json:"V3Score"`
	}
	func parseScoreFromVendorAttribute(ctx context.Context, vendorAttribute string) (NvdV3Score float64) {
	var data map[string]CVSS
	err := json.Unmarshal([]byte(vendorAttribute), &data)
	if err != nil {
	log.G(ctx).Errorf("failed to parse vendor_attribute, error %v", err)
	return 0
	}
	if cvss, ok := data["CVSS"]; ok {
	return cvss.NVD.V3Score
	}
	return 0
	}

to fallback to redhat if nvd doesn't exist.