-
Notifications
You must be signed in to change notification settings - Fork 1
Open
Description
Hello, while fuzzing this implementation, I discovered that it is invalidating valid CVSS v2 vectors.
For instance, let's take the NVD CVSS v2 calculator as a reference.
Build any vector with base and environmental metrics different from Not Defined. Let's say (AV:L/AC:M/Au:S/C:N/I:N/A:P/CDP:N/TD:ND/CR:M/IR:ND/AR:ND)
.
The following Go code shows your implementation does not properly validate it as it raises an error where there should not be.
package main
import (
"fmt"
gocvss "github.com/umisama/go-cvss"
)
func main() {
vec, err := gocvss.ParseVectors("(AV:L/AC:M/Au:S/C:N/I:N/A:P/CDP:N/TD:ND/CR:M/IR:ND/AR:ND)")
fmt.Printf("vec: %v\n", vec)
fmt.Printf("err: %v\n", err)
}
produces ->
vec:
err: invalid vectors string: (AV:L/AC:M/Au:S/C:N/I:N/A:P/CDP:N/TD:ND/CR:M/IR:ND/AR:ND)
Metadata
Metadata
Assignees
Labels
No labels