Trivy: cvss-vector

[okazaki-hajime-ca]

---

FEATURE REQUEST

Description

add cvss vector status

[jnsgruk]

Would also love to see this, have written a hacky workaround in the mean time which works pretty well in a CI pipeline :) https://github.com/jnsgruk/trivy-cvss-tools

[lizrice]

Full database should include CVSS v2 and v3, vectors & scores, from NVD and from appropriate vendor

[knqyf263]

@simar7 Would you work on it?

[mattlorimor]

I'm not sure if this is the correct place to make this request or whether it should be a separate issue, but it looks like it's pretty closely related and could be added or discussed while this is worked on.

It would be nice if the JSON output contained the vendor score, the CVSSv3 score/vector (if available), and the CVSSv2 score/vector (if available).

I'm bringing this up simply to make some downstream processes for some users more streamlined. Compliance frameworks such as FedRAMP strictly define how programs should rate CVEs in their environments:

Common Vulnerability Scoring System (CVSS) Risk Scoring: For any vulnerability with a CVSSv3
base score assigned in the latest version of the NVD, the CVSSv3 base score must be used as the
original risk rating. If no CVSSv3 score is available, a CVSSv2 base score is acceptable where
available. If no CVSS score is available, the native scanner base risk score can be used.

Source

_Technically_ this would probably fall under:

If no CVSS score is available, the native scanner base risk score can be used.

However, the unmodified CVSSv3 score is what programs like FedRAMP want for an original risk rating. It wouldn't, where possible, want the original risk rating overridden by the vendor. Including the raw CVSS data that is available in the JSON output would allow programs using Trivy to more easily follow the steps in the rubric quoted above.

For example, seeing something like this:

[
  {
    "Target": "alpine:3.7 (alpine 3.7.3)",
    "Vulnerabilities": [
      {
        "VulnerabilityID": "CVE-2019-14697",
        "PkgName": "musl",
        "InstalledVersion": "1.1.18-r3",
        "FixedVersion": "1.1.18-r4",
        "Layer": {
          "Digest": "sha256:5d20c808ce198565ff70b3ed23a991dd49afac45dece63474b27ce6ed036adc6",
          "DiffID": "sha256:3fc64803ca2de7279269048fe2b8b3c73d4536448c87c32375b2639ac168a48b"
        },
        "Severity": "HIGH"
      }
    ]
  }
]

instead output as:

[
  {
    "Target": "alpine:3.7 (alpine 3.7.3)",
    "Vulnerabilities": [
      {
        "VulnerabilityID": "CVE-2019-14697",
        "PkgName": "musl",
        "InstalledVersion": "1.1.18-r3",
        "FixedVersion": "1.1.18-r4",
        "Layer": {
          "Digest": "sha256:5d20c808ce198565ff70b3ed23a991dd49afac45dece63474b27ce6ed036adc6",
          "DiffID": "sha256:3fc64803ca2de7279269048fe2b8b3c73d4536448c87c32375b2639ac168a48b"
        },
        "Severity": "HIGH",
        "CVSSv3Score": "9.8",
        "CVSSv3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "CVSSv2Score": "7.5",
        "CVSSv2Vector": "(AV:N/AC:L/Au:N/C:P/I:P/A:P)"
      }
    ]
  }
]

All that said, adding _just_ the CVSS vector would be an improvement since the score should be able to be calculated from that.

[lizrice]

Agreed, the score should be present as well as the vector

[knqyf263]

CVSS score/vector were added at v0.9.2