Malformed CVSS vector string in Postgres advisory

[keshav-space]

Postgres severity is missing cvss prefix and version in vector string.

Error while computing score for postgresql/CVE-2023-39418: CVSS3MalformedError('Malformed CVSS3 vector "AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" is missing mandatory prefix or uses unsupported CVSS version')

[ziadhany]

This is a CVSS v2 vector, not CVSS v3. However, it is also invalid. See:

>> from cvss import CVSS2, CVSS3, CVSS4
>> vector = "AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
>> c = CVSS2(vector)
>> print(vector)
    raise CVSS2MalformedError(
        'Unknown metric "{0}" in field "{1}"'.format(metric, field)
    )
cvss.exceptions.CVSS2MalformedError: Unknown metric "PR" in field "PR:L"

[keshav-space]

@ziadhany this is reported as cvss 3.0 in postgres advisory https://www.postgresql.org/support/security/CVE-2023-39418/

[ziadhany]

This is confusing. For CVSS v3, the version is usually specified. This is actually a CVSS v3.0 vector. I believe this is a bug in the libary we use. See:

c = CVSS3("CVSS:3.0/" + vector)
print(vector)
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

We should just add a CVSS:3.0/ prefix to the vector if it doesn't already have one.

[keshav-space]

@ziadhany vector coming from postgres is alright, we should add "cvss:3.0/" prefix to vector string while storing it.