Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support CVSS Version 3.1 #26

Closed
Fubinator opened this issue Oct 2, 2020 · 2 comments · Fixed by #60
Closed

Support CVSS Version 3.1 #26

Fubinator opened this issue Oct 2, 2020 · 2 comments · Fixed by #60
Labels
help wanted Extra attention is needed

Comments

@Fubinator
Copy link
Member

Fubinator commented Oct 2, 2020

Currently, it is only possible to use CVSS 3.0 vectors. In the future, I think it is a good idea to support Version 3.1 of the CVSS. The metrics of version 3.1 and 3.0 are identical, but the calculation is different.
When #8 is implemented, we can dynamically check which version the vector has and run the calculations based on that. When no version is specified we should use version 3.0, because it seems to be the most common version at the moment.

This issue could be split into multiple parts. I'm not exactly sure, yet.

@Fubinator Fubinator added the help wanted Extra attention is needed label Oct 2, 2020
@Fubinator
Copy link
Member Author

Fubinator commented Oct 9, 2020

After some thinking I came to the conclusion that maybe we should split the cvss.js file first.

  1. Functions that are version-independent utility functions should be written to a file. (e.g. parseVectorObjectToString, isVectorValid)
  2. Version dependent functions for calculation etc. should also be in a separate file.(e.g. calculateISC, calculateExploitability)

The more we split the version dependent functions into a separate file we can just add other files for other versions and determine with #8 which functions to use.

@Fubinator
Copy link
Member Author

Fubinator commented Oct 13, 2020

After investigation, it's seems like we need to implement exactly two things:

  1. A roundUp ffunction which takes care of IEEE 754 floating point math ref1 ref2. All calculations for version 3.1 need to use this function. The function itself will be implemented with Version 3.1 compliant roundUp function #54.
  2. The ModifiedImpact formula for the environmental score has changed. ref

Fubinator added a commit that referenced this issue Oct 14, 2020
@Fubinator Fubinator mentioned this issue Oct 14, 2020
5 tasks
Fubinator added a commit that referenced this issue Oct 14, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted Extra attention is needed
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant