cvss-suite 1.2.3 → 2.0.0

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: '09094d21733286857b9b006672aa297d88858737f58656b2b48627d23bce3e69'
4
- data.tar.gz: 524220ad72a9e052adc3742d3b32d1df3d66f0f5bf0a0c8cfd83265bf5e58d09
3
+ metadata.gz: 5917987479ecee6f2a020076b59751dda816e259d984a540bd1b6c0fb40b6422
4
+ data.tar.gz: 5225e8afd1e553709590bc2bb1a60955c76462d62bbfe825bf2a2081d4647163
5
5
  SHA512:
6
- metadata.gz: 9d871c1e5397598c1261c293524abee855f5c925e62c1e57aeb07473c7ec00c4c98c7ec146623b3a1e9737d0a0016a33098ac539c872762c88502f123501c69e
7
- data.tar.gz: 3fed8bb40cab71f344a6bd339b50c75120942595ffbed2e4b4f0d534ef778ac0619681e648c95a74fac59615a748dd8a94931f0934744948a20ce7306b050e17
6
+ metadata.gz: 6824cf5f7f04f2f8eb5ef5613e61fd86b275b36fd316c7f4d4d60af8f9422176b1485eefe24de482e9dc98c328291ed2a7bccafdec3f03d353fae505c43d988c
7
+ data.tar.gz: 2014e6368dea9deecd623d88a7f7b4d4c5367d1cb3a832ebdac3f6b47d5308b03e1129d157a11dad7e6ac93645ca971ad8dc4b8d85efdd83145f0f58883af6a4
@@ -0,0 +1,21 @@
1
+ name: Rubocop
2
+
3
+ on: [push,pull_request]
4
+
5
+ jobs:
6
+ build:
7
+
8
+ runs-on: ubuntu-latest
9
+
10
+ steps:
11
+ - uses: actions/checkout@v2
12
+ - name: Set up Ruby 2.7
13
+ uses: actions/setup-ruby@v1
14
+ with:
15
+ ruby-version: 2.7
16
+ - name: Build
17
+ run: |
18
+ gem install bundler -v "=> 1.10"
19
+ gem install rubocop
20
+ - name: Run tests
21
+ run: rubocop -F --fail-level C -f s
data/.rubocop.yml CHANGED
@@ -1,40 +1,13 @@
1
1
  inherit_from: .rubocop_todo.yml
2
2
 
3
+ AllCops:
4
+ TargetRubyVersion: 2.4
5
+
3
6
  Metrics/LineLength:
4
7
  Max: 120
5
- Exclude:
6
- - 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
7
- - 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
8
-
9
- Metrics/ClassLength:
10
- Exclude:
11
- - 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
12
- - 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
13
-
14
- Metrics/MethodLength:
15
- Exclude:
16
- - 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
17
- - 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
18
-
19
- Metrics/BlockLength:
20
- Exclude:
21
- - 'spec/cvss3/cvss3_spec.rb'
22
- - 'spec/cvss31/cvss31_spec.rb'
23
-
24
- Style/IfUnlessModifier:
25
- Exclude:
26
- - 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
27
- - 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
28
-
29
- Style/GuardClause:
30
- Exclude:
31
- - 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
32
- - 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
33
-
34
- Style/ConditionalAssignment:
35
- Exclude:
36
- - 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
37
- - 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
38
8
 
39
9
  Style/FrozenStringLiteralComment:
40
10
  Enabled: false
11
+
12
+ Style/AsciiComments:
13
+ Enabled: false
data/.rubocop_todo.yml CHANGED
@@ -1,3 +1,4 @@
1
+ # This configuration was generated by
1
2
  # `rubocop --auto-gen-config`
2
3
  # on 2020-05-05 17:47:10 +0200 using RuboCop version 0.82.0.
3
4
  # The point is for the user to remove these configuration records
@@ -16,13 +17,6 @@ Lint/UselessAccessModifier:
16
17
  Exclude:
17
18
  - 'lib/cvss_suite.rb'
18
19
 
19
- # Offense count: 3
20
- Lint/UselessAssignment:
21
- Exclude:
22
- - 'lib/cvss_suite/cvss.rb'
23
- - 'lib/cvss_suite/cvss3/cvss3_environmental.rb'
24
- - 'lib/cvss_suite/cvss31/cvss31_environmental.rb'
25
-
26
20
  # Offense count: 8
27
21
  # Configuration parameters: IgnoredMethods.
28
22
  Metrics/AbcSize:
@@ -32,12 +26,7 @@ Metrics/AbcSize:
32
26
  # Configuration parameters: CountComments, ExcludedMethods.
33
27
  # ExcludedMethods: refine
34
28
  Metrics/BlockLength:
35
- Max: 50
36
-
37
- # Offense count: 2
38
- # Configuration parameters: CountComments.
39
- Metrics/ClassLength:
40
- Max: 102
29
+ Max: 58
41
30
 
42
31
  # Offense count: 2
43
32
  # Configuration parameters: CountComments.
@@ -68,57 +57,3 @@ Metrics/PerceivedComplexity:
68
57
  Naming/AccessorMethodName:
69
58
  Exclude:
70
59
  - 'lib/cvss_suite/cvss_property.rb'
71
-
72
- # Offense count: 31
73
- # Configuration parameters: AllowedChars.
74
- Style/AsciiComments:
75
- Enabled: false
76
-
77
- # Offense count: 20
78
- Style/Documentation:
79
- Enabled: false
80
-
81
- # Offense count: 2
82
- # Configuration parameters: MinBodyLength.
83
- Style/GuardClause:
84
- Exclude:
85
- - 'lib/cvss_suite/helpers/extensions.rb'
86
-
87
- # Offense count: 1
88
- # Cop supports --auto-correct.
89
- Style/IfUnlessModifier:
90
- Exclude:
91
- - 'lib/cvss_suite.rb'
92
-
93
- # Offense count: 2
94
- # Cop supports --auto-correct.
95
- # Configuration parameters: EnforcedStyle.
96
- # SupportedStyles: literals, strict
97
- Style/MutableConstant:
98
- Exclude:
99
- - 'lib/cvss_suite.rb'
100
- - 'lib/cvss_suite/version.rb'
101
-
102
- # Offense count: 8
103
- # Cop supports --auto-correct.
104
- # Configuration parameters: Strict.
105
- Style/NumericLiterals:
106
- MinDigits: 7
107
-
108
- # Offense count: 3
109
- # Cop supports --auto-correct.
110
- # Configuration parameters: AutoCorrect, EnforcedStyle, IgnoredMethods.
111
- # SupportedStyles: predicate, comparison
112
- Style/NumericPredicate:
113
- Exclude:
114
- - 'spec/**/*'
115
- - 'lib/cvss_suite/cvss2/cvss2_base.rb'
116
- - 'lib/cvss_suite/helpers/extensions.rb'
117
-
118
- # Offense count: 1
119
- # Cop supports --auto-correct.
120
- # Configuration parameters: ConvertCodeThatCanStartToReturnNil, AllowedMethods.
121
- # AllowedMethods: present?, blank?, presence, try, try!
122
- Style/SafeNavigation:
123
- Exclude:
124
- - 'lib/cvss_suite/cvss_metric.rb'
data/CHANGES.md CHANGED
@@ -2,18 +2,11 @@
2
2
  All notable changes to this project will be documented in this file.
3
3
  This project adheres to [Semantic Versioning](http://semver.org/).
4
4
 
5
- ## [1.2.3] - 2020-12-05
5
+ ## [2.0.0] - 2020-05-10
6
6
 
7
- ### Fixes
8
- * CVSS v2 now returns the correct severity values based on NVD recommendation
9
- * CVSS v2 now supports vectors which are enclosed in parenthesis e.g. (AV:N/AC:L/Au:N/C:P/I:P/A:P)
10
-
11
- ## [1.2.2] - 2020-07-19
12
-
13
- ### Fixes
14
- Fixed an error that resulted in incorrect environmental score if modified attributes were not defined.
15
-
16
- ## [1.2.1] - 2020-05-10
7
+ ### Breaking Changes
8
+ * Ruby >= 2.4 is now required
9
+ * Renamed choice/choices to value/values
17
10
 
18
11
  ### Improvements
19
12
  * Added CvssSuite module to every class (thanks to @fwininger)
@@ -106,4 +99,4 @@ Tried to fix an error. It turned out to be a local problem. Due to this I increa
106
99
 
107
100
  ## [1.0.0] - 2016-04-15
108
101
  ### Initial release
109
- First release of this gem.
102
+ First release of this gem.
data/README.md CHANGED
@@ -1,20 +1,15 @@
1
1
  # CvssSuite for Ruby
2
2
 
3
3
  [![Gem Version](http://img.shields.io/gem/v/cvss-suite.svg)](https://rubygems.org/gems/cvss-suite)
4
- [![Ruby Version](https://img.shields.io/badge/Ruby-2.x-brightgreen.svg)](https://rubygems.org/gems/cvss-suite)
4
+ [![Ruby Version](https://img.shields.io/badge/Ruby-2.4-brightgreen.svg)](https://rubygems.org/gems/cvss-suite)
5
5
  [![Cvss Support](https://img.shields.io/badge/CVSS-v2-brightgreen.svg)](https://www.first.org/cvss/v2/guide)
6
6
  [![Cvss Support](https://img.shields.io/badge/CVSS-v3.0-brightgreen.svg)](https://www.first.org/cvss/v3.0/user-guide)
7
7
  [![Cvss Support](https://img.shields.io/badge/CVSS-v3.1-brightgreen.svg)](https://www.first.org/cvss/v3.1/user-guide)
8
- ![RSpec](https://github.com/siemens/cvss-suite/workflows/RSpec/badge.svg)
8
+ [![RSpec](https://github.com/siemens/cvss-suite/workflows/RSpec/badge.svg)](https://github.com/siemens/cvss-suite/actions)
9
9
 
10
10
  This Ruby gem helps you to process the vector of the [**Common Vulnerability Scoring System**](https://www.first.org/cvss/specification-document).
11
11
  Besides calculating the Base, Temporal and Environmental Score, you are able to extract the selected option.
12
12
 
13
- ## :warning: End of life :warning:
14
-
15
- This version of the gem is no longer supported, please update to a higher version.
16
- Please read the [changelog of 2.0.0](https://github.com/siemens/cvss-suite/blob/master/CHANGES.md#200---2020-05-10) for breaking changes.
17
-
18
13
  ## Installation
19
14
 
20
15
  Add this line to your application's Gemfile:
@@ -30,6 +25,10 @@ And then execute:
30
25
  Or install it yourself as:
31
26
 
32
27
  $ gem install cvss-suite
28
+
29
+ ## Version 1.x
30
+
31
+ If your still using CvssSuite 1.x please refer to the [specific branch](https://github.com/siemens/cvss-suite/tree/1.x) for documentation and changelog.
33
32
 
34
33
  ## Usage
35
34
 
@@ -67,15 +66,15 @@ overall_score = cvss.overall_score # 3.2
67
66
  access_vector = cvss.base.access_vector.name # 'Access Vector'
68
67
  remediation_level = cvss.temporal.remediation_level.name # 'Remediation Level'
69
68
 
70
- access_vector.choices.each do |choice|
71
- choice[:name] # 'Local', 'Adjacent Network', 'Network'
72
- choice[:abbreviation] # 'L', 'A', 'N'
73
- choice[:selected] # false, true, false
69
+ access_vector.values.each do |value|
70
+ value[:name] # 'Local', 'Adjacent Network', 'Network'
71
+ value[:abbreviation] # 'L', 'A', 'N'
72
+ value[:selected] # false, true, false
74
73
  end
75
74
 
76
75
  # Selected options
77
- cvss.base.access_vector.selected_choice[:name] # Adjacent Network
78
- cvss.temporal.remediation_level.selected_choice[:name] # Temporary Fix
76
+ cvss.base.access_vector.selected_value[:name] # Adjacent Network
77
+ cvss.temporal.remediation_level.selected_value[:name] # Temporary Fix
79
78
 
80
79
  # Exceptions
81
80
 
@@ -105,11 +104,13 @@ Properties (Access Vector, Remediation Level, etc) do have a position attribute,
105
104
 
106
105
  Currently it is not possible to leave an attribute blank instead of ND/X. If you don't have a value for an attribute, please use ND/X instead.
107
106
 
107
+ Because the documentation isn't clear on how to calculate the score if Modified Scope (CVSS 3.0 Environmental) is not defined, Modified Scope has to have a valid value (S/U).
108
+
108
109
  There is a possibility of implementations generating different scores (+/- 0,1) due to small floating-point inaccuracies. This can happen due to differences in floating point arithmetic between different languages and hardware platforms.
109
110
 
110
111
  ## Changelog
111
112
 
112
- [Click here to see all changes.](https://github.com/siemens/cvss-suite/blob/1.x/CHANGES.md)
113
+ [Click here to see all changes.](https://github.com/siemens/cvss-suite/blob/master/CHANGES.md)
113
114
 
114
115
  ## Contributing
115
116
 
data/cvss_suite.gemspec CHANGED
@@ -26,9 +26,7 @@ Gem::Specification.new do |spec|
26
26
  Besides calculating the Base, Temporal and Environmental Score, you are able to extract the selected option.'
27
27
  spec.homepage = 'https://siemens.github.io/cvss-suite/'
28
28
 
29
- spec.post_install_message = 'Version 1.x of this gem is no longer supported, please update to a supported version.'
30
-
31
- spec.required_ruby_version = '>= 2.0.0'
29
+ spec.required_ruby_version = '>= 2.4.0'
32
30
  spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
33
31
  spec.bindir = 'exe'
34
32
  spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
@@ -8,26 +8,22 @@
8
8
  # This work is licensed under the terms of the MIT license.
9
9
  # See the LICENSE.md file in the top-level directory.
10
10
 
11
- ##
12
- # This class represents any CVSS vector. Do not instantiate this class!
13
-
14
11
  module CvssSuite
12
+ ##
13
+ # This class represents any CVSS vector. Do not instantiate this class!
15
14
  class Cvss
16
15
  ##
17
16
  # Metric of a CVSS vector.
18
-
19
17
  attr_reader :base, :temporal, :environmental
20
18
 
21
19
  ##
22
20
  # Returns the vector itself.
23
-
24
21
  attr_reader :vector
25
22
 
26
23
  ##
27
24
  # Creates a new CVSS vector by a +vector+.
28
25
  #
29
26
  # Raises an exception if it is called on Cvss class.
30
-
31
27
  def initialize(vector)
32
28
  raise CvssSuite::Errors::InvalidParentClass, 'Do not instantiate this class!' if self.class == Cvss
33
29
 
@@ -39,7 +35,6 @@ module CvssSuite
39
35
 
40
36
  ##
41
37
  # Returns if CVSS vector is valid.
42
-
43
38
  def valid?
44
39
  if @amount_of_properties == required_amount_of_properties
45
40
  base = @base.valid?
@@ -54,7 +49,6 @@ module CvssSuite
54
49
 
55
50
  ##
56
51
  # Returns the severity of the CVSS vector.
57
-
58
52
  def severity
59
53
  check_validity
60
54
 
@@ -62,13 +56,13 @@ module CvssSuite
62
56
 
63
57
  if score == 0.0
64
58
  'None'
65
- elsif (0.1..3.9).include? score
59
+ elsif (0.1..3.9).cover? score
66
60
  'Low'
67
- elsif (4.0..6.9).include? score
61
+ elsif (4.0..6.9).cover? score
68
62
  'Medium'
69
- elsif (7.0..8.9).include? score
63
+ elsif (7.0..8.9).cover? score
70
64
  'High'
71
- elsif (9.0..10.0).include? score
65
+ elsif (9.0..10.0).cover? score
72
66
  'Critical'
73
67
  else
74
68
  'None'
@@ -77,7 +71,6 @@ module CvssSuite
77
71
 
78
72
  ##
79
73
  # Returns the Overall Score of the CVSS vector.
80
-
81
74
  def overall_score
82
75
  check_validity
83
76
  return temporal_score if @temporal.valid? && !@environmental.valid?
@@ -107,18 +100,7 @@ module CvssSuite
107
100
  if start_of_vector.nil?
108
101
  ''
109
102
  else
110
- if start_of_vector == 1
111
- matchArray = @vector.scan(/\((?>[^)(]+|\g<0>)*\)/)
112
- if matchArray.length == 1 && matchArray[0] == @vector
113
- @vector.slice!(0)
114
- @vector.slice!(@vector.length - 1)
115
- @vector
116
- else
117
- ''
118
- end
119
- else
120
- @vector[start_of_vector..-1]
121
- end
103
+ @vector[start_of_vector..-1]
122
104
  end
123
105
  end
124
106
 
@@ -126,7 +108,7 @@ module CvssSuite
126
108
  total = @base.count if @base.valid?
127
109
  total += @temporal.count if @temporal.valid?
128
110
  total += @environmental.count if @environmental.valid?
129
- total ||= 0
111
+ total || 0
130
112
  end
131
113
  end
132
114
  end
@@ -13,39 +13,18 @@ require_relative 'cvss2_base'
13
13
  require_relative 'cvss2_temporal'
14
14
  require_relative 'cvss2_environmental'
15
15
 
16
- ##
17
- # This class represents a CVSS vector in version 2.
18
-
19
16
  module CvssSuite
17
+ ##
18
+ # This class represents a CVSS vector in version 2.
20
19
  class Cvss2 < Cvss
21
20
  ##
22
21
  # Returns the Version of the CVSS vector.
23
-
24
22
  def version
25
23
  2
26
24
  end
27
25
 
28
- # Returns the severity of the CVSSv2 vector.
29
- # https://nvd.nist.gov/vuln-metrics/cvss
30
- def severity
31
- check_validity
32
-
33
- score = overall_score
34
-
35
- if (0.0..3.9).include? score
36
- 'Low'
37
- elsif (4.0..6.9).include? score
38
- 'Medium'
39
- elsif (7.0..10.0).include? score
40
- 'High'
41
- else
42
- 'None'
43
- end
44
- end
45
-
46
26
  ##
47
27
  # Returns the Base Score of the CVSS vector.
48
-
49
28
  def base_score
50
29
  check_validity
51
30
  @base.score.round(1)
@@ -53,14 +32,12 @@ module CvssSuite
53
32
 
54
33
  ##
55
34
  # Returns the Temporal Score of the CVSS vector.
56
-
57
35
  def temporal_score
58
36
  (base_score * @temporal.score).round(1)
59
37
  end
60
38
 
61
39
  ##
62
40
  # Returns the Environmental Score of the CVSS vector.
63
-
64
41
  def environmental_score
65
42
  return temporal_score unless @environmental.valid?
66
43
 
@@ -11,14 +11,12 @@
11
11
  require_relative '../cvss_property'
12
12
  require_relative '../cvss_metric'
13
13
 
14
- ##
15
- # This class represents a CVSS Base metric in version 2.
16
-
17
14
  module CvssSuite
15
+ ##
16
+ # This class represents a CVSS Base metric in version 2.
18
17
  class Cvss2Base < CvssMetric
19
18
  ##
20
19
  # Property of this metric
21
-
22
20
  attr_reader :access_vector, :access_complexity, :authentication,
23
21
  :confidentiality_impact, :integrity_impact, :availability_impact
24
22
 
@@ -27,13 +25,12 @@ module CvssSuite
27
25
  # See CVSS documentation for further information https://www.first.org/cvss/v2/guide#i3.2.1 .
28
26
  #
29
27
  # Takes +Security+ +Requirement+ +Impacts+ for calculating environmental score.
30
-
31
28
  def score(sr_cr_score = 1, sr_ir_score = 1, sr_ar_score = 1)
32
29
  impact = calc_impact(sr_cr_score, sr_ir_score, sr_ar_score)
33
30
 
34
31
  exploitability = calc_exploitability
35
32
 
36
- additional_impact = (impact == 0 ? 0 : 1.176)
33
+ additional_impact = (impact.zero? ? 0 : 1.176)
37
34
 
38
35
  ((0.6 * impact) + (0.4 * exploitability) - 1.5) * additional_impact
39
36
  end
@@ -43,32 +40,32 @@ module CvssSuite
43
40
  def init_properties
44
41
  @properties.push(@access_vector =
45
42
  CvssProperty.new(name: 'Access Vector', abbreviation: 'AV', position: [0],
46
- choices: [{ name: 'Network', abbreviation: 'N', weight: 1.0 },
43
+ values: [{ name: 'Network', abbreviation: 'N', weight: 1.0 },
47
44
  { name: 'Adjacent Network', abbreviation: 'A', weight: 0.646 },
48
45
  { name: 'Local', abbreviation: 'L', weight: 0.395 }]))
49
46
  @properties.push(@access_complexity =
50
47
  CvssProperty.new(name: 'Access Complexity', abbreviation: 'AC', position: [1],
51
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.71 },
48
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.71 },
52
49
  { name: 'Medium', abbreviation: 'M', weight: 0.61 },
53
50
  { name: 'High', abbreviation: 'H', weight: 0.35 }]))
54
51
  @properties.push(@authentication =
55
52
  CvssProperty.new(name: 'Authentication', abbreviation: 'Au', position: [2],
56
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.704 },
53
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.704 },
57
54
  { name: 'Single', abbreviation: 'S', weight: 0.56 },
58
55
  { name: 'Multiple', abbreviation: 'M', weight: 0.45 }]))
59
56
  @properties.push(@confidentiality_impact =
60
57
  CvssProperty.new(name: 'Confidentiality Impact', abbreviation: 'C', position: [3],
61
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
58
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
62
59
  { name: 'Partial', abbreviation: 'P', weight: 0.275 },
63
60
  { name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
64
61
  @properties.push(@integrity_impact =
65
62
  CvssProperty.new(name: 'Integrity Impact', abbreviation: 'I', position: [4],
66
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
63
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
67
64
  { name: 'Partial', abbreviation: 'P', weight: 0.275 },
68
65
  { name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
69
66
  @properties.push(@availability_impact =
70
67
  CvssProperty.new(name: 'Availability Impact', abbreviation: 'A', position: [5],
71
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
68
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
72
69
  { name: 'Partial', abbreviation: 'P', weight: 0.275 },
73
70
  { name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
74
71
  end
@@ -11,22 +11,21 @@
11
11
  require_relative '../cvss_property'
12
12
  require_relative '../cvss_metric'
13
13
 
14
- ##
15
- # This class represents a CVSS Environmental metric in version 2.
16
-
17
14
  module CvssSuite
15
+ ##
16
+ # This class represents a CVSS Environmental metric in version 2.
18
17
  class Cvss2Environmental < CvssMetric
19
18
  ##
20
19
  # Property of this metric
21
-
22
20
  attr_reader :collateral_damage_potential, :target_distribution, :security_requirements_cr,
23
21
  :security_requirements_ir, :security_requirements_ar
24
22
 
25
23
  ##
26
24
  # Returns score of this metric
27
-
28
25
  def score(base, temporal_score)
29
- base_score = (base.score @security_requirements_cr.score, @security_requirements_ir.score, @security_requirements_ar.score).round(1)
26
+ base_score = base.score(@security_requirements_cr.score,
27
+ @security_requirements_ir.score,
28
+ @security_requirements_ar.score).round(1)
30
29
 
31
30
  adjusted_temporal = (base_score * temporal_score).round(1)
32
31
  (adjusted_temporal + (10 - adjusted_temporal) * @collateral_damage_potential.score) * @target_distribution.score
@@ -37,7 +36,7 @@ module CvssSuite
37
36
  def init_properties
38
37
  @properties.push(@collateral_damage_potential =
39
38
  CvssProperty.new(name: 'Collateral Damage Potential', abbreviation: 'CDP', position: [6, 9],
40
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
39
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
41
40
  { name: 'Low', abbreviation: 'L', weight: 0.1 },
42
41
  { name: 'Low-Medium', abbreviation: 'LM', weight: 0.3 },
43
42
  { name: 'Medium-High', abbreviation: 'MH', weight: 0.4 },
@@ -45,26 +44,26 @@ module CvssSuite
45
44
  { name: 'Not Defined', abbreviation: 'ND', weight: 0.0 }]))
46
45
  @properties.push(@target_distribution =
47
46
  CvssProperty.new(name: 'Target Distribution', abbreviation: 'TD', position: [7, 10],
48
- choices: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
47
+ values: [{ name: 'None', abbreviation: 'N', weight: 0.0 },
49
48
  { name: 'Low', abbreviation: 'L', weight: 0.25 },
50
49
  { name: 'Medium', abbreviation: 'M', weight: 0.75 },
51
50
  { name: 'High', abbreviation: 'H', weight: 1.0 },
52
51
  { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
53
52
  @properties.push(@security_requirements_cr =
54
53
  CvssProperty.new(name: 'Confidentiality Requirement', abbreviation: 'CR', position: [8, 11],
55
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
54
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
56
55
  { name: 'Medium', abbreviation: 'M', weight: 1.0 },
57
56
  { name: 'High', abbreviation: 'H', weight: 1.51 },
58
57
  { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
59
58
  @properties.push(@security_requirements_ir =
60
59
  CvssProperty.new(name: 'Integrity Requirement', abbreviation: 'IR', position: [9, 12],
61
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
60
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
62
61
  { name: 'Medium', abbreviation: 'M', weight: 1.0 },
63
62
  { name: 'High', abbreviation: 'H', weight: 1.51 },
64
63
  { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
65
64
  @properties.push(@security_requirements_ar =
66
65
  CvssProperty.new(name: 'Availability Requirement', abbreviation: 'AR', position: [10, 13],
67
- choices: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
66
+ values: [{ name: 'Low', abbreviation: 'L', weight: 0.5 },
68
67
  { name: 'Medium', abbreviation: 'M', weight: 1.0 },
69
68
  { name: 'High', abbreviation: 'H', weight: 1.51 },
70
69
  { name: 'Not Defined', abbreviation: 'ND', weight: 1.0 }]))
@@ -11,19 +11,16 @@
11
11
  require_relative '../cvss_property'
12
12
  require_relative '../cvss_metric'
13
13
 
14
- ##
15
- # This class represents a CVSS Temporal metric in version 2.
16
-
17
14
  module CvssSuite
15
+ ##
16
+ # This class represents a CVSS Temporal metric in version 2.
18
17
  class Cvss2Temporal < CvssMetric
19
18
  ##
20
19
  # Property of this metric
21
-
22
20
  attr_reader :exploitability, :remediation_level, :report_confidence
23
21
 
24
22
  ##
25
23
  # Returns score of this metric
26
-
27
24
  def score
28
25
  return 1 unless valid?
29
26
 
@@ -35,14 +32,14 @@ module CvssSuite
35
32
  def init_properties
36
33
  @properties.push(@exploitability =
37
34
  CvssProperty.new(name: 'Exploitability', abbreviation: 'E', position: [6],
38
- choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
35
+ values: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
39
36
  { name: 'Unproven', abbreviation: 'U', weight: 0.85 },
40
37
  { name: 'Proof-of-Concept', abbreviation: 'POC', weight: 0.9 },
41
38
  { name: 'Functional', abbreviation: 'F', weight: 0.95 },
42
39
  { name: 'High', abbreviation: 'H', weight: 1 }]))
43
40
  @properties.push(@remediation_level =
44
41
  CvssProperty.new(name: 'Remediation Level', abbreviation: 'RL', position: [7],
45
- choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
42
+ values: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
46
43
  { name: 'Official Fix', abbreviation: 'OF', weight: 0.87 },
47
44
  { name: 'Temporary Fix', abbreviation: 'TF', weight: 0.9 },
48
45
  { name: 'Workaround', abbreviation: 'W', weight: 0.95 },
@@ -50,7 +47,7 @@ module CvssSuite
50
47
 
51
48
  @properties.push(@report_confidence =
52
49
  CvssProperty.new(name: 'Report Confidence', abbreviation: 'RC', position: [8],
53
- choices: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
50
+ values: [{ name: 'Not Defined', abbreviation: 'ND', weight: 1 },
54
51
  { name: 'Unconfirmed', abbreviation: 'UC', weight: 0.9 },
55
52
  { name: 'Uncorroborated', abbreviation: 'UR', weight: 0.95 },
56
53
  { name: 'Confirmed', abbreviation: 'C', weight: 1 }]))