Added cvss_v4 field (#654)

jasnow · web-flow · commit ce343c5e4156 · 2023-06-26T17:36:00.000-07:00
diff --git a/README.md b/README.md
@@ -129,6 +129,7 @@ patched_versions:
 * `description` \[String\] (required): One or more paragraphs describing the vulnerability. It may contain multiple paragraphs.
 * `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability.
 * `cvss_v3` \[Float\] (optional): The [CVSSv3] score for the vulnerability.
+* `cvss_v4` \[Float\] (optional): The [CVSSv4] score for the vulnerability.
 * `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the
   unaffected versions of the Ruby library.
 * `patched_versions` \[Array\<String\>\] (optional): The version requirements for the
@@ -149,6 +150,7 @@ patched_versions:
 * `description` \[String\] (required): One or more paragraphs describing the vulnerability. It may contain multiple paragraphs.
 * `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability.
 * `cvss_v3` \[Float\] (optional): The [CVSSv3] score for the vulnerability.
+* `cvss_v4` \[Float\] (optional): The [CVSSv4] score for the vulnerability.
 * `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the
   unaffected versions of the Ruby implementation.
 * `patched_versions` \[Array\<String\>\] (optional): The version requirements for the
@@ -157,7 +159,8 @@ patched_versions:
 * `notes` \[String\] (optional): Internal notes regarding the vulnerability's inclusion in this database.
 
 [CVSSv2]: https://www.first.org/cvss/v2/guide
-[CVSSv3]: https://www.first.org/cvss/user-guide
+[CVSSv3]: https://www.first.org/cvss/v3.1/user-guide
+[CVSSv4]: https://www.first.org/cvss/v4.0/user-guide
 
 ### Tests
 
@@ -194,6 +197,7 @@ GH_API_TOKEN=<your GitHub API Token> bundle exec rake sync_github_advisories[gem
 - The rake task will write yaml files for any missing advisories.
 - Those files must be further edited.
   - Fill in `cvss_v3` field by following the CVE link and getting it from page
+  - Fill in `cvss_v4` field by following the CVE link and getting it from page
   - Fill in `patched_versions` field, using the comments at the bottom of the file
   - Fill in `unaffected_versions`, optional, if there are unaffected_versions
   - delete the GitHub data at the bottom of the yaml file
@@ -216,6 +220,7 @@ developed by the Open Security Foundation (OSF) and its contributors.
 [OSVDB]: https://en.wikipedia.org/wiki/Open_Source_Vulnerability_Database
 [GHSA]: https://help.github.com/en/articles/about-maintainer-security-advisories
 [CVSSv2]: https://www.first.org/cvss/v2/guide
-[CVSSv3]: https://www.first.org/cvss/user-guide
+[CVSSv3]: https://www.first.org/cvss/v3.1/user-guide
+[CVSSv4]: https://www.first.org/cvss/v4.0/user-guide
 [YAML]: http://www.yaml.org/
 [CONTRIBUTORS.md]: https://github.com/rubysec/ruby-advisory-db/blob/master/CONTRIBUTORS.md
diff --git a/lib/github_advisory_sync.rb b/lib/github_advisory_sync.rb
@@ -230,7 +230,7 @@ def merge_data(saved_data)
 
       KEYS = %w[
         gem library framework platform cve osvdb ghsa url title date description
-        cvss_v2 cvss_v3 unaffected_versions patched_versions related notes
+        cvss_v2 cvss_v3 cvss_v4 unaffected_versions patched_versions related notes
       ].freeze
     end
 
@@ -367,6 +367,7 @@ def create(package)
 
       new_data = package.merge_data(
         "cvss_v3"             => ("<FILL IN IF AVAILABLE>" unless cvss),
+        "cvss_v4"             => "<FILL IN IF AVAILABLE>",
         "unaffected_versions" => ["<OPTIONAL: FILL IN SEE BELOW>"]
       )
 
diff --git a/spec/advisory_example.rb b/spec/advisory_example.rb
@@ -168,6 +168,21 @@
       end
     end
 
+    describe "cvss_v4" do
+      subject { advisory['cvss_v4'] }
+
+      it "may be nil or a Float" do
+        expect(subject).to be_kind_of(Float).or(be_nil)
+      end
+
+      case advisory['cvss_v4']
+      when Float
+        context "when a Float" do
+          it { expect(subject).to be_between(0.0, 10.0) }
+        end
+      end
+    end
+
     describe "patched_versions" do
       subject { advisory['patched_versions'] }
 
diff --git a/spec/schemas/gem.yml b/spec/schemas/gem.yml
@@ -35,6 +35,8 @@ mapping:
     type: float
   "cvss_v3":
     type: float
+  "cvss_v4":
+    type: float
   "unaffected_versions":
     type: seq
     sequence:
diff --git a/spec/schemas/ruby.yml b/spec/schemas/ruby.yml
@@ -32,6 +32,8 @@ mapping:
     type: float
   "cvss_v3":
     type: float
+  "cvss_v4":
+    type: float
   "unaffected_versions":
     type: seq
     sequence:
