cvss-suite 3.3.0 → 4.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 773b87ded42d73797271e4dd4c05a261b69bc957295fe75654084f4edf4a4521
-  data.tar.gz: e5ecc4e25e13cc8663ca12cbb8b065246ee25b0e44fbfb6bfdbbfdb61ef16b61
+  metadata.gz: 615e1ce401360d6127ec8a397b0d919b581588cbebe00d48fa1a8354d51397bc
+  data.tar.gz: e8a8615c60983eae67971a2b86d465afc79be4ae5b0c0c099504b676f1a1e74c
 SHA512:
-  metadata.gz: 3538af971b672a09547bc6f1286714876c7fe4ee61d19d4fddfaf961c42b014040cabd4259c0e22cb177064109d877a7339101ff7258afeb1b3ed937ed3cc516
-  data.tar.gz: 8b3ffb3367ee5437b1ee0026ca7f1677da233c844124455886c580cb2cedc5cd0b72c712a920741dc942600fc58a99c4f88f3c6c3b23ae750c962e6cc3ba1907
+  metadata.gz: f68645079416546c5bb80e0a2ec0688a58e6889f9d334621130d563c882e90b735a9d2cad8bdf00c7e92c79b5d233e4bbca645d81347715dbacb25448addde30
+  data.tar.gz: e4bf4cd7073062cc9a2504d6f4cda6485d7b187c22ec9928740b9af89a2a990baa220f54b3843931cb43d27b5851290ad18c2f4ddbfc350990c425a7b7c0df6a

data/.github/workflows/rspec.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        ruby: [ '2.6', '2.7', '3.0', '3.1', '3.2', '3.3' ]
+        ruby: [ '2.6', '2.7', '3.0', '3.1', '3.2', '3.3', '3.4' ]
     steps:
     - uses: actions/checkout@v4
     - name: Set up ${{ matrix.ruby }}

data/CHANGES.md

@@ -2,6 +2,22 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [4.1.0] - 2025-04-27
+
+### Improvements
+* Expose impact and exploitability sub-scores. (@jgarber-cisco)
+
+## [4.0.0] - 2024-08-31
+
+### Breaking Changes
+* Removed score method for all CVSS 4.0 metrics. Since CVSS 4.0 only has one score, it doesn't make sense for each metric to return a separate score. See [#46](https://github.com/0llirocks/cvss-suite/issues/46) for more information.
+
+## [3.3.0] - 2024-08-31
+
+### Improvements
+* Prepare support for ruby 3.4. Closes [#44](https://github.com/0llirocks/cvss-suite/issues/44). Many thanks to @HParker for adding this feature.
+* Add score method for CVSS 4.0 and later as an alias for overall_score.
+
 ## [3.2.2] - 2024-08-04
 
 ### Fixes

data/LICENSE.md

@@ -12,6 +12,8 @@ Contributors:
 - joePedantic <https://github.com/joePedantic>
 - Brandyn Phelps <https://github.com/brphelps>
 - Karim ElGhandour <https://github.com/kghandour>
+- Adam Hess <https://github.com/HParker>
+- Jason Garber <https://github.com/jgarber>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

data/README.md

@@ -33,6 +33,10 @@ Or install it yourself as:
 
     $ gem install cvss-suite
 
+## Version 3.x
+
+If you are still using CvssSuite 3.x please refer to the [specific branch](https://github.com/0llirocks/cvss-suite/tree/3.x) for documentation and changelog.
+
 ## Version 2.x
 
 If you are still using CvssSuite 2.x please refer to the [specific branch](https://github.com/0llirocks/cvss-suite/tree/2.x) for documentation and changelog.

data/lib/cvss_suite/cvss2/cvss2_base.rb

@@ -30,6 +30,14 @@ module CvssSuite
       ((0.6 * impact) + (0.4 * exploitability) - 1.5) * additional_impact
     end
 
+    def impact_subscore
+      calc_impact.round(1)
+    end
+
+    def exploitability_subscore
+      calc_exploitability.round(1)
+    end
+
     private
 
     def init_properties
@@ -65,7 +73,7 @@ module CvssSuite
                                                    { name: 'Complete', abbreviation: 'C', weight: 0.66 }]))
     end
 
-    def calc_impact(sr_cr_score, sr_ir_score, sr_ar_score)
+    def calc_impact(sr_cr_score = 1, sr_ir_score = 1, sr_ar_score = 1)
       confidentiality_score = 1 - @confidentiality_impact.score * sr_cr_score
       integrity_score = 1 - @integrity_impact.score * sr_ir_score
       availability_score = 1 - @availability_impact.score * sr_ar_score

data/lib/cvss_suite/cvss3/cvss3_base.rb

@@ -19,18 +19,8 @@ module CvssSuite
     ##
     # Returns score of this metric
     def score
-      privilege_score = Cvss3Helper.privileges_required_score @privileges_required, @scope
-
-      exploitability = 8.22 * @attack_vector.score * @attack_complexity.score *
-                       privilege_score * @user_interaction.score
-
-      isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
-
-      impact_sub_score = if @scope.selected_value[:name] == 'Changed'
-                           7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
-                         else
-                           6.42 * isc_base
-                         end
+      exploitability = calc_exploitability
+      impact_sub_score = calc_impact
 
       return 0 if impact_sub_score <= 0
 
@@ -41,6 +31,14 @@ module CvssSuite
       end
     end
 
+    def impact_subscore
+      calc_impact.round(1)
+    end
+
+    def exploitability_subscore
+      calc_exploitability.round(1)
+    end
+
     private
 
     def init_properties
@@ -83,5 +81,22 @@ module CvssSuite
                                                    { name: 'Low', abbreviation: 'L', weight: 0.22 },
                                                    { name: 'High', abbreviation: 'H', weight: 0.56 }]))
     end
+
+    def calc_exploitability
+      privilege_score = Cvss3Helper.privileges_required_score @privileges_required, @scope
+
+      8.22 * @attack_vector.score * @attack_complexity.score *
+        privilege_score * @user_interaction.score
+    end
+
+    def calc_impact
+      isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
+
+      if @scope.selected_value[:name] == 'Changed'
+        7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
+      else
+        6.42 * isc_base
+      end
+    end
   end
 end

data/lib/cvss_suite/cvss31/cvss31_base.rb

@@ -20,18 +20,8 @@ module CvssSuite
     ##
     # Returns score of this metric
     def score
-      privilege_score = Cvss3Helper.privileges_required_score(@privileges_required, @scope)
-
-      exploitability = 8.22 * @attack_vector.score * @attack_complexity.score *
-                       privilege_score * @user_interaction.score
-
-      isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
-
-      impact_sub_score = if @scope.selected_value[:name] == 'Changed'
-                           7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
-                         else
-                           6.42 * isc_base
-                         end
+      exploitability = calc_exploitability
+      impact_sub_score = calc_impact
 
       return 0 if impact_sub_score <= 0
 
@@ -42,6 +32,14 @@ module CvssSuite
       end
     end
 
+    def impact_subscore
+      calc_impact.round(1)
+    end
+
+    def exploitability_subscore
+      calc_exploitability.round(1)
+    end
+
     private
 
     def init_properties
@@ -84,5 +82,22 @@ module CvssSuite
                                                    { name: 'Low', abbreviation: 'L', weight: 0.22 },
                                                    { name: 'High', abbreviation: 'H', weight: 0.56 }]))
     end
+
+    def calc_exploitability
+      privilege_score = Cvss3Helper.privileges_required_score(@privileges_required, @scope)
+
+      8.22 * @attack_vector.score * @attack_complexity.score *
+        privilege_score * @user_interaction.score
+    end
+
+    def calc_impact
+      isc_base = 1 - ((1 - @confidentiality.score) * (1 - @integrity.score) * (1 - @availability.score))
+
+      if @scope.selected_value[:name] == 'Changed'
+        7.52 * (isc_base - 0.029) - 3.25 * (isc_base - 0.02)**15
+      else
+        6.42 * isc_base
+      end
+    end
   end
 end

data/lib/cvss_suite/cvss40/cvss40_all_up.rb

@@ -10,7 +10,7 @@ require_relative 'cvss40_threat'
 
 module CvssSuite
   ##
-  # This class represents a CVSS Threat metric in version 3.1.
+  # This class represents all CVSS metrics combined in version 4.0.
   class Cvss40AllUp < CvssMetric
     ##
     # Returns score of this metric

data/lib/cvss_suite/cvss40/cvss40_base.rb

@@ -18,12 +18,6 @@ module CvssSuite
                 :vulnerable_system_confidentiality, :vulnerable_system_integrity, :vulnerable_system_availability,
                 :subsequent_system_confidentiality, :subsequent_system_integrity, :subsequent_system_availability
 
-    ##
-    # Returns score of this metric
-    def score
-      Cvss40CalcHelper.new(@properties.map { |p| [p.abbreviation, p.selected_value[:abbreviation]] }.to_h).score
-    end
-
     private
 
     def init_properties

data/lib/cvss_suite/cvss40/cvss40_environmental.rb

@@ -18,12 +18,6 @@ module CvssSuite
                 :modified_subsequent_system_confidentiality, :modified_subsequent_system_integrity,
                 :modified_subsequent_system_availability
 
-    ##
-    # Returns score of this metric
-    def score
-      Cvss40CalcHelper.new(@properties.map { |p| [p.abbreviation, p.selected_value[:abbreviation]] }.to_h).score
-    end
-
     private
 
     def init_properties

data/lib/cvss_suite/cvss40/cvss40_environmental_security.rb

@@ -14,12 +14,6 @@ module CvssSuite
     # Property of this metric
     attr_reader :confidentiality_requirements, :integrity_requirements, :availability_requirements
 
-    ##
-    # Returns score of this metric
-    def score
-      Cvss40CalcHelper.new(@properties.map { |p| [p.abbreviation, p.selected_value[:abbreviation]] }.to_h).score
-    end
-
     private
 
     def init_properties

data/lib/cvss_suite/cvss40/cvss40_supplemental.rb

@@ -15,14 +15,6 @@ module CvssSuite
     attr_reader :safety, :automatable, :recovery, :value_density,
                 :vulnerability_response_effort, :provider_urgency
 
-    ##
-    # Returns score of this metric
-    def score
-      return 1.0 unless valid?
-
-      @exploit_code_maturity.score * @remediation_level.score * @report_confidence.score
-    end
-
     private
 
     def init_properties

data/lib/cvss_suite/cvss40/cvss40_threat.rb

@@ -14,12 +14,6 @@ module CvssSuite
     # Property of this metric
     attr_reader :exploit_maturity
 
-    ##
-    # Returns score of this metric
-    def score
-      Cvss40CalcHelper.new(@properties.map { |p| [p.abbreviation, p.selected_value[:abbreviation]] }.to_h).score
-    end
-
     private
 
     def init_properties

data/lib/cvss_suite/cvss_40_and_later.rb

@@ -10,8 +10,8 @@ module CvssSuite
   # This class represents any CVSS vector. Do not instantiate this class!
   class Cvss40AndLater < Cvss
     ##
-    # Metric of a CVSS vector for CVSS 2, 3, 3.1.
-    attr_reader :temporal, :environmental
+    # Metric of a CVSS vector for CVSS 4.0.
+    attr_reader :supplemental, :environmental, :environmental_security, :threat
 
     ##
     # Creates a new CVSS vector by a +vector+, for all CVSS versions from 4.0.

data/lib/cvss_suite/version.rb

@@ -4,5 +4,5 @@
 # See the LICENSE.md file in the top-level directory.
 
 module CvssSuite
-  VERSION = '3.3.0'.freeze
+  VERSION = '4.1.0'.freeze
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: cvss-suite
 version: !ruby/object:Gem::Version
-  version: 3.3.0
+  version: 4.1.0
 platform: ruby
 authors:
 - 0llirocks
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-08-31 00:00:00.000000000 Z
+date: 2025-04-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -84,7 +83,6 @@ description: |-
   This Ruby gem calculates the score based on the vector of the
   Common Vulnerability Scoring System (https://www.first.org/cvss/specification-document)
   in version 4.0, 3.1, 3.0 and 2.
-email: 
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -150,10 +148,9 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/0llirocks/cvss-suite/issues
   changelog_uri: https://github.com/0llirocks/cvss-suite/blob/master/CHANGES.md
-  documentation_uri: https://www.rubydoc.info/gems/cvss-suite/3.3.0
+  documentation_uri: https://www.rubydoc.info/gems/cvss-suite/4.1.0
   homepage_uri: https://cvss-suite.0lli.rocks
   source_code_uri: https://github.com/0llirocks/cvss-suite
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -168,8 +165,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.6.0.dev
 specification_version: 4
 summary: Ruby gem for processing cvss vectors.
 test_files: []