Yield VulnerabilitySeverity extracted from a mapping of OSV ``raw_data``
(raw_data)
| 137 | |
| 138 | |
| 139 | def get_severities(raw_data) -> Iterable[VulnerabilitySeverity]: |
| 140 | """ |
| 141 | Yield VulnerabilitySeverity extracted from a mapping of OSV ``raw_data`` |
| 142 | """ |
| 143 | try: |
| 144 | for severity in raw_data.get("severity") or []: |
| 145 | vector = severity.get("score") |
| 146 | valid_vector = vector[:-1] if vector and vector.endswith("/") else vector |
| 147 | |
| 148 | if severity.get("type") == "CVSS_V3": |
| 149 | system = SCORING_SYSTEMS["cvssv3.1"] |
| 150 | score = system.compute(valid_vector) |
| 151 | yield VulnerabilitySeverity(system=system, value=score, scoring_elements=vector) |
| 152 | |
| 153 | elif severity.get("type") == "CVSS_V4": |
| 154 | system = SCORING_SYSTEMS["cvssv4"] |
| 155 | score = system.compute(valid_vector) |
| 156 | yield VulnerabilitySeverity(system=system, value=score, scoring_elements=vector) |
| 157 | |
| 158 | else: |
| 159 | logger.error( |
| 160 | f"Unsupported severity type: {severity!r} for OSV id: {raw_data.get('id')!r}" |
| 161 | ) |
| 162 | except (CVSS3MalformedError, CVSS4MalformedError) as e: |
| 163 | logger.error(f"Invalid severity {e}") |
| 164 | |
| 165 | ecosystem_specific = raw_data.get("ecosystem_specific") or {} |
| 166 | severity = ecosystem_specific.get("severity") |
| 167 | if severity: |
| 168 | yield VulnerabilitySeverity( |
| 169 | system=SCORING_SYSTEMS["generic_textual"], |
| 170 | value=severity, |
| 171 | ) |
| 172 | |
| 173 | database_specific = raw_data.get("database_specific") or {} |
| 174 | severity = database_specific.get("severity") |
| 175 | if severity: |
| 176 | yield VulnerabilitySeverity( |
| 177 | system=SCORING_SYSTEMS["generic_textual"], |
| 178 | value=severity, |
| 179 | ) |
| 180 | |
| 181 | |
| 182 | def get_references(raw_data, severities) -> List[Reference]: |
no test coverage detected