Skip to content

Commit d94357c

Browse files
committed
Update readme.md
1 parent 38b1c5b commit d94357c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

docs/readme.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Code
22

3-
I've had the misfortune of having to write several CVSS libraries in Python, this is my latest attempt at one that is tested and re-usable. Due to the nature of the CVSS v2 and v3 specifications (terrible 'reference code', huge amount of state and fiddly maths + corner cases) the current open source Python libraries for manipulating cvss are somewhat terrible and unmaintained. The only current implementation of v3 [has a (broken) 300 line function full of conditionals to handle vectors](https://github.com/toolswatch/pycvss3/blob/master/lib/pycvss3.py#L36), and while [some that implement v2](https://github.com/esn89/cvss-v2-calc) have better code quality they still lack tests and an importable API. There are a couple that are quite nice, including (cvss_util)[https://bitbucket.org/asecurityteam/cvss_util]
3+
I've had the misfortune of having to write several CVSS libraries in Python, this is my latest attempt at one that is tested and re-usable. Due to the nature of the CVSS v2 and v3 specifications (terrible 'reference code', huge amount of state and fiddly maths + corner cases) the current open source Python libraries for manipulating cvss are somewhat terrible and unmaintained. The only current implementation of v3 [has a (broken) 300 line function full of conditionals to handle vectors](https://github.com/toolswatch/pycvss3/blob/master/lib/pycvss3.py#L36), and while [some that implement v2](https://github.com/esn89/cvss-v2-calc) have better code quality they still lack tests and an importable API. There are a couple that are quite nice, including [cvss_util](https://bitbucket.org/asecurityteam/cvss_util)
44

55
There is also a lack of a useful reference implementation. There is an official calculator for v2 and v3, but these are useless for automated testing. The v3 is all in JavaScript (and unpublished I might add, so you have to dig through the undocumented page JS), and you would need to screen-scrape the NIST website to automate the v2 calculator. Eww.
66

0 commit comments

Comments
 (0)