Skip to content

Conversation

@parroty
Copy link
Contributor

@parroty parroty commented Dec 11, 2022

Hi 👋 . How do you think about adding cvss_score column? I believe it's one good attribute to review, in addition to the standard severity (critical, high, etc.).

Note

  • Some of the alerts don't have CVSS scores, but the API returns the score as 0.0.

Example dependabot_list.csv (Excerpt)

number,state,created_at,updated_at,fixed_at,dismissed_at,dismissed_by,dismissed_reason,html_url,dependency_manifest,dependency_ecosystem,dependency_name,severity,ghsa_id,cve_id,cvss_score
26,fixed,2022-12-11T10:58:29Z,2022-12-11T11:25:12Z,2022-12-11T11:25:12Z,none,none,none,https://github.com/xxx/yyy/security/dependabot/26,yarn.lock,npm,qs,high,GHSA-hrpp-h998-j3pp,CVE-2022-24999,7.5
25,fixed,2022-12-11T10:58:29Z,2022-12-11T11:25:12Z,2022-12-11T11:25:12Z,none,none,none,https://github.com/xxx/yyy/security/dependabot/25,yarn.lock,npm,express,high,GHSA-hrpp-h998-j3pp,CVE-2022-24999,7.5
...
16,fixed,2022-09-08T04:48:47Z,2022-12-11T11:25:11Z,2022-12-11T11:25:11Z,none,none,none,https://github.com/xxx/yyy/security/dependabot/16,yarn.lock,npm,mongodb-query-parser,high,GHSA-hxmg-hm46-cf62,CVE-2020-24391,0.0
15,fixed,2022-09-08T04:48:47Z,2022-12-11T11:25:11Z,2022-12-11T11:25:11Z,none,none,none,https://github.com/xxx/yyy/security/dependabot/15,yarn.lock,npm,mongodb-query-parser,critical,GHSA-97mg-3cr6-3x4c,,0.0

Reference

        "cvss": {
            "type": "object",
            "description": "Details for the advisory pertaining to the Common Vulnerability Scoring System.",
            "readOnly": true,
            "properties": {
              "score": {
                "type": "number",
                "description": "The overall CVSS score of the advisory.",
                "minimum": 0,
                "maximum": 10,
                "readOnly": true
              },
              "vector_string": {
                "type": [
                  "string",
                  "null"
                ],
                "description": "The full CVSS vector string for the advisory.",
                "readOnly": true
              }
            },
            "required": [
              "score",
              "vector_string"
            ],
            "additionalProperties": false
          },

Copy link

@some-natalie some-natalie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great to me! Thank you!!!

@some-natalie some-natalie merged commit 0dbc9d5 into advanced-security:main Dec 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants