Module: Homebrew::Vulns::CVSS Private

Defined in:
vulns/cvss.rb

Overview

This module is part of a private API. This module may only be used in the Homebrew/brew repository. Third parties should avoid using this module if possible, as it may be removed or changed without warning.

CVSS v3.0/v3.1 base score and qualitative severity rating. See https://www.first.org/cvss/v3-1/specification-document. v2 and v4.0 vectors return nil so callers fall through to the next available severity source.

Class Method Summary collapse

Class Method Details

.base_score(vector) ⇒ Float?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Float, nil) 


23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'vulns/cvss.rb', line 23

def self.base_score(vector)
  metrics = parse(vector)
  return if metrics.nil?

  scope_changed = metrics.fetch("S") == "C"
  pr_table = scope_changed ? PR_CHANGED : PR_UNCHANGED

  av  = AV.fetch(metrics.fetch("AV"))
  ac  = AC.fetch(metrics.fetch("AC"))
  pr  = pr_table.fetch(metrics.fetch("PR"))
  ui  = UI.fetch(metrics.fetch("UI"))
  c   = CIA.fetch(metrics.fetch("C"))
  i   = CIA.fetch(metrics.fetch("I"))
  a   = CIA.fetch(metrics.fetch("A"))

  iss = 1 - ((1 - c) * (1 - i) * (1 - a))
  impact = if scope_changed
    (7.52 * (iss - 0.029)) - (3.25 * ((iss - 0.02)**15))
  else
    6.42 * iss
  end
  return 0.0 if impact <= 0

  exploitability = 8.22 * av * ac * pr * ui
  raw = impact + exploitability
  raw *= 1.08 if scope_changed
  round_up([raw, 10.0].min)
end

.severity(vector) ⇒ Symbol?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



53
54
55
56
57
58
59
60
61
62
 
# File 'vulns/cvss.rb', line 53

def self.severity(vector)
  score = base_score(vector)
  return if score.nil?

  if score >= 9.0 then :critical
  elsif score >= 7.0 then :high
  elsif score >= 4.0 then :medium
  elsif score > 0.0 then :low
  end
end