@@ -20,8 +20,12 @@ import (
2020 "errors"
2121 "fmt"
2222 "regexp"
23+ "strings"
2324
24- cvss "github.com/goark/go-cvss/v3/metric"
25+ gocvss20 "github.com/pandatix/go-cvss/20"
26+ gocvss30 "github.com/pandatix/go-cvss/30"
27+ gocvss31 "github.com/pandatix/go-cvss/31"
28+ gocvss40 "github.com/pandatix/go-cvss/40"
2529)
2630
2731// CVE Information of a linked CVE vulnerability.
@@ -100,22 +104,42 @@ func (cve *CVE) Validate() (err error) {
100104 return errors .New ("string CVSS vector missing from CVE data" )
101105 }
102106
103- var bm cvss. Metrics
104- // Parse the vector string to make sure it is well formed
105- if len (cve .CVSSVector ) == 44 {
106- bm , err = cvss . NewBase (). Decode ( cve . CVSSVector )
107- } else {
108- bm , err = cvss . NewTemporal (). Decode ( cve . CVSSVector )
109- }
107+ switch {
108+ default : // CVSS v2.0 has no prefix
109+ _ , err := gocvss20 . ParseVector (cve .CVSSVector )
110+ if err != nil {
111+ return fmt . Errorf ( "parsing CVSS vector string: %w" , err )
112+ }
113+ // FIRST ORG has no calculator for CVSS v2.0
110114
111- if err != nil {
112- return fmt .Errorf ("parsing CVSS vector string: %w" , err )
115+ case strings .HasPrefix (cve .CVSSVector , "CVSS:3.0" ):
116+ _ , err := gocvss30 .ParseVector (cve .CVSSVector )
117+ if err != nil {
118+ return fmt .Errorf ("parsing CVSS vector string: %w" , err )
119+ }
120+ cve .CalcLink = fmt .Sprintf (
121+ "https://www.first.org/cvss/calculator/3.0#%s" , cve .CVSSVector ,
122+ )
123+
124+ case strings .HasPrefix (cve .CVSSVector , "CVSS:3.1" ):
125+ _ , err := gocvss31 .ParseVector (cve .CVSSVector )
126+ if err != nil {
127+ return fmt .Errorf ("parsing CVSS vector string: %w" , err )
128+ }
129+ cve .CalcLink = fmt .Sprintf (
130+ "https://www.first.org/cvss/calculator/3.1#%s" , cve .CVSSVector ,
131+ )
132+
133+ case strings .HasPrefix (cve .CVSSVector , "CVSS:4.0" ):
134+ _ , err := gocvss40 .ParseVector (cve .CVSSVector )
135+ if err != nil {
136+ return fmt .Errorf ("parsing CVSS vector string: %w" , err )
137+ }
138+ cve .CalcLink = fmt .Sprintf (
139+ "https://www.first.org/cvss/calculator/4.0#%s" , cve .CVSSVector ,
140+ )
113141 }
114142
115- cve .CalcLink = fmt .Sprintf (
116- "https://www.first.org/cvss/calculator/%s#%s" , bm .BaseMetrics ().Ver .String (), cve .CVSSVector ,
117- )
118-
119143 if cve .CVSSScore == 0 {
120144 return errors .New ("missing CVSS score from CVE data" )
121145 }
0 commit comments