Fix: improve handling of malformed severity vectors. (#793)

* Fix: improve handling of malformed severity vectors.

Ospd-openvas handles base metrics only. If there are any optional metric the task fails.
With this patch, the error is handled in a way that task can continue.

* Add: tests

Author: jjnicola

ospd/cvss.py

@@ -17,9 +17,14 @@
 
 """ Common Vulnerability Scoring System handling class. """
 
+import logging
+
 import math
 from typing import List, Dict, Optional
 
+logger = logging.getLogger(__name__)
+
+
 CVSS_V2_METRICS = {
     'AV': {'L': 0.395, 'A': 0.646, 'N': 1.0},
     'AC': {'H': 0.35, 'M': 0.61, 'L': 0.71},
@@ -74,9 +79,13 @@ def cvss_base_v2_value(cls, cvss_base_vector: str) -> Optional[float]:
         if not cvss_base_vector:
             return None
 
-        _av, _ac, _au, _c, _i, _a = cls._parse_cvss_base_vector(
-            cvss_base_vector
-        )
+        try:
+            _av, _ac, _au, _c, _i, _a = cls._parse_cvss_base_vector(
+                cvss_base_vector
+            )
+        except ValueError:
+            logger.warning('Invalid severity vector %s', cvss_base_vector)
+            return None
 
         _impact = 10.41 * (
             1
@@ -109,9 +118,21 @@ def cvss_base_v3_value(cls, cvss_base_vector: str) -> Optional[float]:
         """
         if not cvss_base_vector:
             return None
-        _ver, _av, _ac, _pr, _ui, _s, _c, _i, _a = cls._parse_cvss_base_vector(
-            cvss_base_vector
-        )
+        try:
+            (
+                _ver,
+                _av,
+                _ac,
+                _pr,
+                _ui,
+                _s,
+                _c,
+                _i,
+                _a,
+            ) = cls._parse_cvss_base_vector(cvss_base_vector)
+        except ValueError:
+            logger.warning('Invalid severity vector %s', cvss_base_vector)
+            return None
 
         scope_changed = CVSS_V3_METRICS['S'].get(_s)
 

tests/test_cvss.py

@@ -35,3 +35,15 @@ def test_cvssv3(self):
         cvss_base = CVSS.cvss_base_v3_value(vector)
 
         self.assertEqual(cvss_base, 3.8)
+
+    def test_cvssv2_optional_metrics(self):
+        vector = 'AV:A/AC:L/Au:S/C:P/I:P/A:P/E:F'
+        cvss_base = CVSS.cvss_base_v2_value(vector)
+
+        self.assertEqual(cvss_base, None)
+
+    def test_cvssv3_optional_metrics(self):
+        vector = 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:X'
+        cvss_base = CVSS.cvss_base_v3_value(vector)
+
+        self.assertEqual(cvss_base, None)