CVE JSON Validation failure of certain CVSS 4 scores

[trolldbois]

The attached file was generated with vulnogram.github.io
CVE-0000-1234.json

cvelib fails when trying to validate that file.

from cvelib import cve_api
import json
filename = 'CVE-0000-1234.json'
record_data_json = json.load(open(filename,'r'))
try:
    cve_api.CveRecord.validate(record_data_json, cve_api.CveRecord.Schemas.V5_SCHEMA)
    print('Success')
except cve_api.CveRecordValidationError as e:
    print('Failure - CVSS base score validation error')
    print(e)

A deep dive seems to point to a failure in the jsonschema dependency ( see python-jsonschema/jsonschema#1274 ) , where jsonschema fails to validate a number in a range.
The error comes back as "7.1 is not a multiple of 0.1"

[trolldbois]

The issue has a solution here: python-jsonschema/jsonschema#1274 (comment)

The solution is to load json files with parse_float=decimal.Decimal

[trolldbois]

Deep down, the error boils to cvss v4 base Score comparison to being a multiple of 0.1 :

# jsonschema._keywords:L172
# quotient = instance / dB
# where instance == 7.1 and dB == 0.1
>>> 7.1/0.1
70.99999999999999

This fails the verification (L174) that int(70.9999..) == 70.9999...
And therefore the baseScore in CVSS 4 fails validation.

[trolldbois]

On Apr 18 2024 , CVEProject/cve-schema seems to have partially fixed/avoided this problem by changing the cvssv4 schema scoreType to list all decimal values, instead of using multipleOf
CVEProject/cve-schema@84a2b1e

Conclusion: There is a new json schema for cvss v4 https://github.com/CVEProject/cve-schema/blob/84a2b1ed8bf98218a822843e06236c1e91cae0f8/schema/imports/cvss/cvss-v4.0.json that also fixes this problem by removing the usage of multipleOf, therefore avoiding the "float bug"

https://github.com/CVEProject/cve-schema/releases/tag/v5.1.0

[mprpic]

Updated to the latest schema files in the linked PR; the 5.1.0 schema that was included in cvelib was I guess still the RC version. I tested the record attached here against the newer schema and it validates correctly.

[trolldbois]

@mprpic would it be possible to has a minor release (pypi) with this fix ?

[mprpic]

@trolldbois

• https://github.com/RedHatProductSecurity/cvelib/releases/tag/1.5.0
• https://pypi.org/project/cvelib/1.5.0/