cvss-suite 2.0.1 → 2.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d4f32e67e6919d58fbd35bc9af64a0af838e484ecfc28d17f83ebc623df9cff5
-  data.tar.gz: fc758c191bfbbd12e24e15d8b2d4fe1e012e4597ea0fcc28972bbe4bb9d8f66d
+  metadata.gz: f109a2e3d49b66723f39c092692b3cabfa75d829d8ef3f0e07cf9d0d238a3755
+  data.tar.gz: 41660286d0173fa19c37dd49b43f4efc5fc1db025ae6a46741baf0694b5199d3
 SHA512:
-  metadata.gz: e6af1a297fb42858352914040f4d7d75923e3d6e88ed0ae14b85243252d58d169a8eddc900fd0ad1f5506a86bfc24f576e8d321fd7f2b4a01afa040ac9861ebc
-  data.tar.gz: fcb7590bd3fbe1eef4c8d5ea4f72e1cf04db96005034f74f9e764cb3853f1e0d39d73a6ba3c77416be69853f01a3c248d880997ae474534f5c8f2e7724a86ff6
+  metadata.gz: c567e0730cf9e4ef3e2e85a5c1fa35a9b949c59ed278a968bbf336732f1229cbcfbd84c34e67256a91a6de058a71b13275cb4d8eefdbaa2c416b18e106aac7ff
+  data.tar.gz: d883de3fdc12def5106855a221a535751c9846104ee37a6ecbe8a391a9e3f59b752696c7e0fd128b0dcf8fbedf60bdaa6a0c3d1d1a625c71204555133a4e365b

data/.rubocop.yml

@@ -2,6 +2,7 @@ inherit_from: .rubocop_todo.yml
 
 AllCops:
   TargetRubyVersion: 2.4
+  SuggestExtensions: false
 
 Metrics/LineLength:
   Max: 120
@@ -21,6 +22,7 @@ Metrics/MethodLength:
 
 Metrics/BlockLength:
   Exclude:
+    - 'spec/cvss2/cvss2_spec.rb'
     - 'spec/cvss3/cvss3_spec.rb'
     - 'spec/cvss31/cvss31_spec.rb'
 

data/CHANGES.md

@@ -2,6 +2,12 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [2.0.2] - 2020-12-05
+
+### Fixes
+* CVSS v2 now returns the correct severity values based on NVD recommendation
+* CVSS v2 now supports vectors which are enclosed in parenthesis e.g. (AV:N/AC:L/Au:N/C:P/I:P/A:P)
+
 ## [2.0.1] - 2020-07-19
 
 ### Fixes

data/README.md

@@ -28,7 +28,7 @@ Or install it yourself as:
     
 ## Version 1.x
 
-If your still using CvssSuite 1.x please refer to the [specific branch](https://github.com/siemens/cvss-suite/tree/1.x) for documentation and changelog.
+If you are still using CvssSuite 1.x please refer to the [specific branch](https://github.com/siemens/cvss-suite/tree/1.x) for documentation and changelog.
 
 ## Usage
 

data/lib/cvss_suite.rb

@@ -20,6 +20,7 @@ require 'cvss_suite/invalid_cvss'
 module CvssSuite
   CVSS_VECTOR_BEGINNINGS = [
     { string: 'AV:', version: 2 },
+    { string: '(AV:', version: 2 },
     { string: 'CVSS:3.0/', version: 3.0 },
     { string: 'CVSS:3.1/', version: 3.1 }
   ].freeze

data/lib/cvss_suite/cvss.rb

@@ -25,7 +25,7 @@ module CvssSuite
     #
     # Raises an exception if it is called on Cvss class.
     def initialize(vector)
-      raise CvssSuite::Errors::InvalidParentClass, 'Do not instantiate this class!' if self.class == Cvss
+      raise CvssSuite::Errors::InvalidParentClass, 'Do not instantiate this class!' if instance_of? Cvss
 
       @vector = vector
       @properties = []
@@ -54,7 +54,7 @@ module CvssSuite
 
       score = overall_score
 
-      if score == 0.0
+      if score <= 0.0
         'None'
       elsif (0.1..3.9).cover? score
         'Low'
@@ -99,6 +99,15 @@ module CvssSuite
 
       if start_of_vector.nil?
         ''
+      elsif start_of_vector == 1
+        match_array = @vector.scan(/\((?>[^)(]+|\g<0>)*\)/)
+        if match_array.length == 1 && match_array[0] == @vector
+          @vector.slice!(0)
+          @vector.slice!(@vector.length - 1)
+          @vector
+        else
+          ''
+        end
       else
         @vector[start_of_vector..-1]
       end

data/lib/cvss_suite/cvss2/cvss2.rb

@@ -23,6 +23,25 @@ module CvssSuite
       2
     end
 
+    # Returns the severity of the CVSSv2 vector.
+    # https://nvd.nist.gov/vuln-metrics/cvss
+    def severity
+      check_validity
+
+      score = overall_score
+
+      case score
+      when 0.0..3.9
+        'Low'
+      when 4.0..6.9
+        'Medium'
+      when 7.0..10.0
+        'High'
+      else
+        'None'
+      end
+    end
+
     ##
     # Returns the Base Score of the CVSS vector.
     def base_score

data/lib/cvss_suite/errors.rb

@@ -19,10 +19,12 @@ module CvssSuite
 
       def initialize(message)
         @message = message
+        super
       end
     end
 
     class InvalidVector < RuntimeError; end
+
     class InvalidParentClass < ArgumentError; end
   end
 end

data/lib/cvss_suite/invalid_cvss.rb

@@ -12,9 +12,11 @@ module CvssSuite
   ##
   # This class represents a invalid CVSS vector.
   class InvalidCvss < Cvss
+    # rubocop:disable Lint/MissingSuper
     ##
     # Creates a new invalid CVSS vector.
     def initialize; end
+    # rubocop:enable Lint/MissingSuper
 
     ##
     # Since this is an invalid CVSS vector, it always returns false.

data/lib/cvss_suite/version.rb

@@ -1,6 +1,6 @@
 # CVSS-Suite, a Ruby gem to manage the CVSS vector
 #
-# Copyright (c) Siemens AG, 2019
+# Copyright (c) Siemens AG, 2020
 #
 # Authors:
 #   Oliver Hambörger <oliver.hamboerger@siemens.com>
@@ -9,5 +9,5 @@
 # See the LICENSE.md file in the top-level directory.
 
 module CvssSuite
-  VERSION = '2.0.1'.freeze
+  VERSION = '2.0.2'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cvss-suite
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.2
 platform: ruby
 authors:
 - Oliver Hamboerger
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-07-19 00:00:00.000000000 Z
+date: 2020-12-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler