Better handle the CVE score display while it doesn't have scores but has severity value

[xingzhang-suse]

During running test, we found bunch of CVEs which does not have cvss array to contain the scores, so UI only can show n/a in the score badge. However, the severity value is in every CVE. So the badge color will show corresponding the severity level.

We need to work with backend team to confirm if this kind of value is set properly. If so, we need to work with UX designer to have a better display solution about this kind of CVEs.

[flavio]

This data is coming from the vulnerability scanner. It might happen that a vulnerability is disclosed but for some days it's lacking a score. I've seen that happen in some cases.

Unfortunately there's nothing we can do in these cases, other than using n/a.

@xingzhang-suse Can you give me the name of the image and the vulnerability that is lacking this information? Just to double check everything is working as expected.

[xingzhang-suse]

We found some in this image - index.docker.io/library/nats:2.12.4-alpine
CVE-2024-58251 does not have score from backend data.

[flavio]

Can you give me the image digest? The image pointed by the "human tag" has been updated in the meantime, the issue is no longer around

[xingzhang-suse]

The degest is sha256:10c612f3f448b9493f04f2b4053f5476180c45f8fb28e83f46826cc7e8190674

[flavio]

I'm sorry, it looks like the image has been removed:

$ crane manifest nats@sha256:10c612f3f448b9493f04f2b4053f5476180c45f8fb28e83f46826cc7e8190674
Error: fetching manifest nats@sha256:10c612f3f448b9493f04f2b4053f5476180c45f8fb28e83f46826cc7e8190674: GET https://index.docker.io/v2/library/nats/manifests/sha256:10c612f3f448b9493f04f2b4053f5476180c45f8fb28e83f46826cc7e8190674: MANIFEST_UNKNOWN: manifest unknown; unknown manifest name=library/nats revision=sha256:10c612f3f448b9493f04f2b4053f5476180c45f8fb28e83f46826cc7e8190674

The same happens when running trivy against it.

I would suggest, next time you run into a similar issue please run a trivy image <name of the image> and verify whether the vulnerability is marked as without severity also in here.

Personal anecdote, some weeks ago, on a Thursday, trivy found an issue inside of the KW admission controller image. The severity was "n/a" and it stayed like that for a couple of days. On Mon the severity was properly set.
This wasn't an issue with trivy, because looking for the CVE online returned the same data, no severity was set... 🤷