Skip to content

Commit 706a2bf

Browse files
jeremylongjeremylong
authored
feat: report on CVSS v4 (#7204)
1 parent 5245930 commit 706a2bf

18 files changed

Lines changed: 854 additions & 27 deletions

File tree

‎ant/src/main/java/org/owasp/dependencycheck/taskdefs/Check.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2299,6 +2299,7 @@ private void checkForFailure(Dependency[] dependencies) throws BuildException {
22992299
for (Vulnerability v : d.getVulnerabilities()) {
23002300
if ((v.getCvssV2() != null && v.getCvssV2().getCvssData().getBaseScore() >= failBuildOnCVSS)
23012301
|| (v.getCvssV3() != null && v.getCvssV3().getCvssData().getBaseScore() >= failBuildOnCVSS)
2302+
|| (v.getCvssV4() != null && v.getCvssV4().getCvssData().getBaseScore() >= failBuildOnCVSS)
23022303
|| (v.getUnscoredSeverity() != null && SeverityUtil.estimateCvssV2(v.getUnscoredSeverity()) >= failBuildOnCVSS)
23032304
//safety net to fail on any if for some reason the above misses on 0
23042305
|| (failBuildOnCVSS <= 0.0f)) {

‎cli/src/main/java/org/owasp/dependencycheck/App.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -317,15 +317,20 @@ private int determineReturnCode(Engine engine, float cvssFailScore) {
317317
&& v.getCvssV2().getCvssData().getBaseScore() != null ? v.getCvssV2().getCvssData().getBaseScore() : -1;
318318
final Double cvssV3 = v.getCvssV3() != null && v.getCvssV3().getCvssData() != null
319319
&& v.getCvssV3().getCvssData().getBaseScore() != null ? v.getCvssV3().getCvssData().getBaseScore() : -1;
320+
final Double cvssV4 = v.getCvssV4() != null && v.getCvssV4().getCvssData() != null
321+
&& v.getCvssV4().getCvssData().getBaseScore() != null ? v.getCvssV4().getCvssData().getBaseScore() : -1;
320322
final Double unscoredCvss = v.getUnscoredSeverity() != null ? SeverityUtil.estimateCvssV2(v.getUnscoredSeverity()) : -1;
321323

322324
if (cvssV2 >= cvssFailScore
323325
|| cvssV3 >= cvssFailScore
326+
|| cvssV4 >= cvssFailScore
324327
|| unscoredCvss >= cvssFailScore
325328
//safety net to fail on any if for some reason the above misses on 0
326329
|| (cvssFailScore <= 0.0f)) {
327330
double score = 0.0;
328-
if (cvssV3 >= 0.0) {
331+
if (cvssV4 >= 0.0) {
332+
score = cvssV4;
333+
} else if (cvssV3 >= 0.0) {
329334
score = cvssV3;
330335
} else if (cvssV2 >= 0.0) {
331336
score = cvssV2;

‎core/src/main/java/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1006,6 +1006,7 @@ private void checkForFailure(Dependency[] dependencies) throws ScanAgentExceptio
10061006
for (Vulnerability v : d.getVulnerabilities()) {
10071007
if ((v.getCvssV2() != null && v.getCvssV2().getCvssData().getBaseScore() >= failBuildOnCVSS)
10081008
|| (v.getCvssV3() != null && v.getCvssV3().getCvssData().getBaseScore() >= failBuildOnCVSS)
1009+
|| (v.getCvssV4() != null && v.getCvssV4().getCvssData().getBaseScore() >= failBuildOnCVSS)
10091010
|| (v.getUnscoredSeverity() != null && SeverityUtil.estimateCvssV2(v.getUnscoredSeverity()) >= failBuildOnCVSS)
10101011
//safety net to fail on any if for some reason the above misses on 0
10111012
|| (failBuildOnCVSS <= 0.0f)) {

‎core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -518,6 +518,9 @@ public int compareTo(@NotNull Vulnerability o) {
518518
* vulnerability severity
519519
*/
520520
private Double bestEffortSeverityLevelForSorting() {
521+
if (this.cvssV4 != null) {
522+
return SeverityUtil.sortAdjustedCVSSv3BaseScore(this.cvssV4.getCvssData().getBaseScore());
523+
}
521524
if (this.cvssV3 != null) {
522525
return SeverityUtil.sortAdjustedCVSSv3BaseScore(this.cvssV3.getCvssData().getBaseScore());
523526
}
@@ -535,6 +538,9 @@ private Double bestEffortSeverityLevelForSorting() {
535538
* unscored severities that critical is assumed.
536539
*/
537540
public String getHighestSeverityText() {
541+
if (this.cvssV4 != null) {
542+
return this.cvssV4.getCvssData().getBaseSeverity().value().toUpperCase();
543+
}
538544
if (this.cvssV3 != null) {
539545
return this.cvssV3.getCvssData().getBaseSeverity().value().toUpperCase();
540546
}

‎core/src/main/java/org/owasp/dependencycheck/reporting/ReportTool.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,8 @@ public Collection<SarifRule> convertToSarifRules(List<Dependency> dependencies)
9999
buildDescription(v.getDescription(), v.getKnownExploitedVulnerability()),
100100
v.getSource().name(),
101101
v.getCvssV2(),
102-
v.getCvssV3());
102+
v.getCvssV3(),
103+
v.getCvssV4());
103104
rules.put(v.getName(), r);
104105
}
105106
}
@@ -114,6 +115,8 @@ private String determineScore(Vulnerability vuln) {
114115
} else {
115116
return normalizeSeverity(vuln.getUnscoredSeverity().toLowerCase());
116117
}
118+
} else if (vuln.getCvssV4() != null && vuln.getCvssV4().getCvssData().getBaseSeverity() != null) {
119+
return normalizeSeverity(vuln.getCvssV4().getCvssData().getBaseSeverity().value().toLowerCase());
117120
} else if (vuln.getCvssV3() != null && vuln.getCvssV3().getCvssData().getBaseSeverity() != null) {
118121
return normalizeSeverity(vuln.getCvssV3().getCvssData().getBaseSeverity().value().toLowerCase());
119122
} else if (vuln.getCvssV2() != null && vuln.getCvssV2().getCvssData().getBaseSeverity() != null) {

‎core/src/main/java/org/owasp/dependencycheck/reporting/SarifRule.java‎

Lines changed: 48 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919

2020
import io.github.jeremylong.openvulnerability.client.nvd.CvssV2;
2121
import io.github.jeremylong.openvulnerability.client.nvd.CvssV3;
22+
import io.github.jeremylong.openvulnerability.client.nvd.CvssV4;
2223

2324
/**
2425
*
@@ -138,6 +139,14 @@ public class SarifRule {
138139
* CVSS V3 field.
139140
*/
140141
private String cvssv3Version;
142+
/**
143+
* CVSS V4 field.
144+
*/
145+
private String cvssv4BaseScore;
146+
/**
147+
* CVSS V4 Vector.
148+
*/
149+
private String cvssv4Vector;
141150
/**
142151
* The source of the rule.
143152
*/
@@ -154,7 +163,7 @@ public class SarifRule {
154163
* @param cvssV3 the CVSS v3 score
155164
*/
156165
public SarifRule(String name, String shortDescription, String fullDescription,
157-
String source, CvssV2 cvssV2, CvssV3 cvssV3) {
166+
String source, CvssV2 cvssV2, CvssV3 cvssV3, CvssV4 cvssV4) {
158167
this.id = name;
159168
this.name = name;
160169
this.shortDescription = shortDescription;
@@ -232,6 +241,12 @@ public SarifRule(String name, String shortDescription, String fullDescription,
232241
}
233242
this.cvssv3Version = cvssV3.getCvssData().getVersion().name();
234243
}
244+
if (cvssV4 != null && cvssV4.getCvssData() != null) {
245+
if (cvssV4.getCvssData().getBaseScore() != null) {
246+
this.cvssv4BaseScore = cvssV4.getCvssData().getBaseScore().toString();
247+
}
248+
this.cvssv4Vector = cvssV4.toString();
249+
}
235250
}
236251

237252
/**
@@ -757,4 +772,36 @@ public void setId(String id) {
757772
this.id = id;
758773
}
759774

775+
/**
776+
* Get the value of CVSS4 Base Score.
777+
*
778+
* @return the value of CVSS4 Base Score
779+
*/
780+
public String getCvssv4BaseScore() {
781+
return cvssv4BaseScore;
782+
}
783+
784+
/**
785+
* Set the value of CVSS4 Base Score.
786+
* @param cvssv4BaseScore new value of CVSS4 Base Score
787+
*/
788+
public void setCvssv4BaseScore(String cvssv4BaseScore) {
789+
this.cvssv4BaseScore = cvssv4BaseScore;
790+
}
791+
792+
/**
793+
* Get the Cvssv4 Vector.
794+
* @return the Cvssv4 Vector
795+
*/
796+
public String getCvssv4Vector() {
797+
return cvssv4Vector;
798+
}
799+
800+
/**
801+
* Set the Cvssv4 Vector.
802+
* @param cvssv4Vector new value of Cvssv4 Vector
803+
*/
804+
public void setCvssv4Vector(String cvssv4Vector) {
805+
this.cvssv4Vector = cvssv4Vector;
806+
}
760807
}

‎core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionRule.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,11 @@ public void process(Dependency dependency) {
537537
removeVulns.add(v);
538538
break;
539539
}
540+
if (v.getCvssV4() != null && v.getCvssV4().getCvssData().getBaseScore().compareTo(cvss) < 0) {
541+
remove = true;
542+
removeVulns.add(v);
543+
break;
544+
}
540545
}
541546
}
542547
if (remove && !isBase()) {

0 commit comments

Comments
 (0)