@@ -20,8 +20,12 @@ import (
2020 "errors"
2121 "fmt"
2222 "regexp"
23+ "strings"
2324
24- cvss "github.com/goark/go-cvss/v3/metric"
25+ gocvss20 "github.com/pandatix/go-cvss/20"
26+ gocvss30 "github.com/pandatix/go-cvss/30"
27+ gocvss31 "github.com/pandatix/go-cvss/31"
28+ gocvss40 "github.com/pandatix/go-cvss/40"
2529)
2630
2731// CVE Information of a linked CVE vulnerability
@@ -91,19 +95,41 @@ func (cve *CVE) Validate() (err error) {
9195 return errors .New ("string CVSS vector missing from CVE data" )
9296 }
9397
94- var bm cvss.Metrics
95- // Parse the vector string to make sure it is well formed
96- if len (cve .CVSSVector ) == 44 {
97- bm , err = cvss .NewBase ().Decode (cve .CVSSVector )
98- } else {
99- bm , err = cvss .NewTemporal ().Decode (cve .CVSSVector )
100- }
101- if err != nil {
102- return fmt .Errorf ("parsing CVSS vector string: %w" , err )
98+ switch {
99+ default : // CVSS v2.0 has no prefix
100+ _ , err := gocvss20 .ParseVector (cve .CVSSVector )
101+ if err != nil {
102+ return fmt .Errorf ("parsing CVSS vector string: %w" , err )
103+ }
104+ // FIRST ORG has no calculator for CVSS v2.0
105+
106+ case strings .HasPrefix (cve .CVSSVector , "CVSS:3.0" ):
107+ _ , err := gocvss30 .ParseVector (cve .CVSSVector )
108+ if err != nil {
109+ return fmt .Errorf ("parsing CVSS vector string: %w" , err )
110+ }
111+ cve .CalcLink = fmt .Sprintf (
112+ "https://www.first.org/cvss/calculator/3.0#%s" , cve .CVSSVector ,
113+ )
114+
115+ case strings .HasPrefix (cve .CVSSVector , "CVSS:3.1" ):
116+ _ , err := gocvss31 .ParseVector (cve .CVSSVector )
117+ if err != nil {
118+ return fmt .Errorf ("parsing CVSS vector string: %w" , err )
119+ }
120+ cve .CalcLink = fmt .Sprintf (
121+ "https://www.first.org/cvss/calculator/3.1#%s" , cve .CVSSVector ,
122+ )
123+
124+ case strings .HasPrefix (cve .CVSSVector , "CVSS:4.0" ):
125+ _ , err := gocvss40 .ParseVector (cve .CVSSVector )
126+ if err != nil {
127+ return fmt .Errorf ("parsing CVSS vector string: %w" , err )
128+ }
129+ cve .CalcLink = fmt .Sprintf (
130+ "https://www.first.org/cvss/calculator/4.0#%s" , cve .CVSSVector ,
131+ )
103132 }
104- cve .CalcLink = fmt .Sprintf (
105- "https://www.first.org/cvss/calculator/%s#%s" , bm .BaseMetrics ().Ver .String (), cve .CVSSVector ,
106- )
107133
108134 if cve .CVSSScore == 0 {
109135 return errors .New ("missing CVSS score from CVE data" )
0 commit comments