@google-cloud/containeranalysis 6.8.0 → 6.9.0

package/build/protos/grafeas/v1/cvss.proto

@@ -100,70 +100,165 @@ message CVSS {
   // Base Metrics
   // Represents the intrinsic characteristics of a vulnerability that are
   // constant over time and across user environments.
+
+  // Attack Vector (AV). Defined in CVSS v2, v3, v4.
   AttackVector attack_vector = 4;
+  // Attack Complexity (AC). Defined in CVSS v2, v3, v4.
   AttackComplexity attack_complexity = 5;
+  // Authentication (Au). Defined in CVSS v2.
   Authentication authentication = 6;
+  // Privileges Required (PR). Defined in CVSS v3, v4.
   PrivilegesRequired privileges_required = 7;
+  // User Interaction (UI). Defined in CVSS v3, v4.
   UserInteraction user_interaction = 8;
+  // Scope (S). Defined in CVSS v3.
   Scope scope = 9;
+  // Confidentiality Impact (C). Defined in CVSS v2, v3.
   Impact confidentiality_impact = 10;
+  // Integrity Impact (I). Defined in CVSS v2, v3.
   Impact integrity_impact = 11;
+  // Availability Impact (A). Defined in CVSS v2, v3.
   Impact availability_impact = 12;
+  // Attack Requirements (AT). Defined in CVSS v4.
+  AttackRequirements attack_requirements = 13;
+  // Vulnerable System Confidentiality Impact (VC). Defined in CVSS v4.
+  Impact vulnerable_system_confidentiality_impact = 14;
+  // Vulnerable System Integrity Impact (VI). Defined in CVSS v4.
+  Impact vulnerable_system_integrity_impact = 15;
+  // Vulnerable System Availability Impact (VA). Defined in CVSS v4.
+  Impact vulnerable_system_availability_impact = 16;
+  // Subsequent System Confidentiality Impact (SC). Defined in CVSS v4.
+  Impact subsequent_system_confidentiality_impact = 17;
+  // Subsequent System Integrity Impact (SI). Defined in CVSS v4.
+  Impact subsequent_system_integrity_impact = 18;
+  // Subsequent System Availability Impact (SA). Defined in CVSS v4.
+  Impact subsequent_system_availability_impact = 19;
+  // Exploit Maturity (E). Defined in CVSS v4.
+  ExploitMaturity exploit_maturity = 20;
 
+  // Attack Vector.
   enum AttackVector {
+    // Unspecified.
     ATTACK_VECTOR_UNSPECIFIED = 0;
+    // Attack Vector: Network (AV:N). Defined in CVSS v2, v3, v4.
     ATTACK_VECTOR_NETWORK = 1;
+    // Attack Vector: Adjacent (AV:A). Defined in CVSS v2, v3, v4.
     ATTACK_VECTOR_ADJACENT = 2;
+    //  Attack Vector: Local (AV:L). Defined in CVSS v2, v3, v4.
     ATTACK_VECTOR_LOCAL = 3;
+    // Attack Vector: Physical (AV:P). Defined in CVSS v3, v4.
     ATTACK_VECTOR_PHYSICAL = 4;
   }
 
+  // Attack Complexity.
   enum AttackComplexity {
+    // Unspecified.
     ATTACK_COMPLEXITY_UNSPECIFIED = 0;
+    // Low attack complexity (AC:L). Defined in CVSS v2, v3, v4.
     ATTACK_COMPLEXITY_LOW = 1;
+    // High attack complexity (AC:H). Defined in CVSS v2, v3, v4.
     ATTACK_COMPLEXITY_HIGH = 2;
+    // Medium attack complexity (AC:M). Defined in CVSS v2.
     ATTACK_COMPLEXITY_MEDIUM = 3;
   }
 
+  // Authentication.
   enum Authentication {
+    // Unspecified.
     AUTHENTICATION_UNSPECIFIED = 0;
+    // Multiple authentication required (Au:M). Defined in CVSS v2.
     AUTHENTICATION_MULTIPLE = 1;
+    // Single authentication required (Au:S). Defined in CVSS v2.
     AUTHENTICATION_SINGLE = 2;
+    // No authentication required (Au:N). Defined in CVSS v2.
     AUTHENTICATION_NONE = 3;
   }
 
+  // Privileges Required.
   enum PrivilegesRequired {
+    // Unspecified.
     PRIVILEGES_REQUIRED_UNSPECIFIED = 0;
+    // No privileges required (PR:N). Defined in CVSS v3, v4.
     PRIVILEGES_REQUIRED_NONE = 1;
+    // Low privileges required (PR:L). Defined in CVSS v3, v4.
     PRIVILEGES_REQUIRED_LOW = 2;
+    // High privileges required (PR:H). Defined in CVSS v3, v4.
     PRIVILEGES_REQUIRED_HIGH = 3;
   }
 
+  // User Interaction.
   enum UserInteraction {
+    // Unspecified.
     USER_INTERACTION_UNSPECIFIED = 0;
+    // No user interaction required (UI:N). Defined in CVSS v3, v4.
     USER_INTERACTION_NONE = 1;
+    // User interaction required (UI:R). Defined in CVSS v3.
     USER_INTERACTION_REQUIRED = 2;
+    // Passive user interaction required (UI:P). Defined in CVSS v4.
+    USER_INTERACTION_PASSIVE = 3;
+    // Active user interaction required (UI:A). Defined in CVSS v4.
+    USER_INTERACTION_ACTIVE = 4;
   }
 
+  // Scope.
   enum Scope {
+    // Unspecified.
     SCOPE_UNSPECIFIED = 0;
+    // Scope: Unchanged (S:U). Defined in CVSS v3.
     SCOPE_UNCHANGED = 1;
+    // Scope: Changed (S:C). Defined in CVSS v3.
     SCOPE_CHANGED = 2;
   }
 
+  // Impact.
   enum Impact {
+    // Unspecified.
     IMPACT_UNSPECIFIED = 0;
+    // High impact (H). Defined in CVSS v3, v4.
     IMPACT_HIGH = 1;
+    // Low impact (L). Defined in CVSS v3, v4.
     IMPACT_LOW = 2;
+    // No impact (N). Defined in CVSS v2, v3, v4.
     IMPACT_NONE = 3;
+    // Partial impact (P). Defined in CVSS v2.
     IMPACT_PARTIAL = 4;
+    // Complete impact (C). Defined in CVSS v2.
     IMPACT_COMPLETE = 5;
   }
+
+  // Attack Requirements.
+  enum AttackRequirements {
+    // Unspecified.
+    ATTACK_REQUIREMENTS_UNSPECIFIED = 0;
+    // No attack requirements (AT:N). Defined in CVSS v4.
+    ATTACK_REQUIREMENTS_NONE = 1;
+    // Attack requirements: Present (AT:P). Defined in CVSS v4.
+    ATTACK_REQUIREMENTS_PRESENT = 2;
+  }
+
+  // Exploit Maturity (E). Defined in CVSS v4.
+  enum ExploitMaturity {
+    // Unspecified.
+    EXPLOIT_MATURITY_UNSPECIFIED = 0;
+    // Exploit maturity: Not defined (E:X). Defined in CVSS v4.
+    EXPLOIT_MATURITY_NOT_DEFINED = 1;
+    // Exploit maturity: Attacked (E:A). Defined in CVSS v4.
+    EXPLOIT_MATURITY_ATTACKED = 2;
+    // Exploit maturity: Proof-of-concept (E:P). Defined in CVSS v4.
+    EXPLOIT_MATURITY_POC = 3;
+    // Exploit maturity: Unreported (E:U). Defined in CVSS v4.
+    EXPLOIT_MATURITY_UNREPORTED = 4;
+  }
 }
 
 // CVSS Version.
 enum CVSSVersion {
+  // Unspecified.
   CVSS_VERSION_UNSPECIFIED = 0;
+  // CVSS v2.
   CVSS_VERSION_2 = 1;
+  // CVSS v3.
   CVSS_VERSION_3 = 2;
+  // CVSS v4.
+  CVSS_VERSION_4 = 3;
 }

package/build/protos/grafeas/v1/vulnerability.proto

@@ -160,7 +160,10 @@ message VulnerabilityNote {
   // The time this advisory was published by the source.
   google.protobuf.Timestamp advisory_publish_time = 9;
 
-  // Next free ID is 10.
+  // The full description of the v4 CVSS for this vulnerability.
+  CVSS cvss_v4 = 10;
+
+  // Next free ID is 11.
 }
 
 // An occurrence of a severity vulnerability on a resource.
@@ -308,5 +311,8 @@ message VulnerabilityOccurrence {
   // Risk information about the vulnerability, such as CISA, EPSS, etc.
   Risk risk = 15;
 
-  // Next free ID is 16.
+  // The cvss v4 score for the vulnerability.
+  CVSS cvss_v4 = 16;
+
+  // Next free ID is 17.
 }

package/build/protos/protos.d.ts

@@ -6993,6 +6993,30 @@ export namespace grafeas {
 
             /** CVSS availabilityImpact */
             availabilityImpact?: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact|null);
+
+            /** CVSS attackRequirements */
+            attackRequirements?: (grafeas.v1.CVSS.AttackRequirements|keyof typeof grafeas.v1.CVSS.AttackRequirements|null);
+
+            /** CVSS vulnerableSystemConfidentialityImpact */
+            vulnerableSystemConfidentialityImpact?: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact|null);
+
+            /** CVSS vulnerableSystemIntegrityImpact */
+            vulnerableSystemIntegrityImpact?: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact|null);
+
+            /** CVSS vulnerableSystemAvailabilityImpact */
+            vulnerableSystemAvailabilityImpact?: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact|null);
+
+            /** CVSS subsequentSystemConfidentialityImpact */
+            subsequentSystemConfidentialityImpact?: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact|null);
+
+            /** CVSS subsequentSystemIntegrityImpact */
+            subsequentSystemIntegrityImpact?: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact|null);
+
+            /** CVSS subsequentSystemAvailabilityImpact */
+            subsequentSystemAvailabilityImpact?: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact|null);
+
+            /** CVSS exploitMaturity */
+            exploitMaturity?: (grafeas.v1.CVSS.ExploitMaturity|keyof typeof grafeas.v1.CVSS.ExploitMaturity|null);
         }
 
         /** Represents a CVSS. */
@@ -7040,6 +7064,30 @@ export namespace grafeas {
             /** CVSS availabilityImpact. */
             public availabilityImpact: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact);
 
+            /** CVSS attackRequirements. */
+            public attackRequirements: (grafeas.v1.CVSS.AttackRequirements|keyof typeof grafeas.v1.CVSS.AttackRequirements);
+
+            /** CVSS vulnerableSystemConfidentialityImpact. */
+            public vulnerableSystemConfidentialityImpact: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact);
+
+            /** CVSS vulnerableSystemIntegrityImpact. */
+            public vulnerableSystemIntegrityImpact: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact);
+
+            /** CVSS vulnerableSystemAvailabilityImpact. */
+            public vulnerableSystemAvailabilityImpact: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact);
+
+            /** CVSS subsequentSystemConfidentialityImpact. */
+            public subsequentSystemConfidentialityImpact: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact);
+
+            /** CVSS subsequentSystemIntegrityImpact. */
+            public subsequentSystemIntegrityImpact: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact);
+
+            /** CVSS subsequentSystemAvailabilityImpact. */
+            public subsequentSystemAvailabilityImpact: (grafeas.v1.CVSS.Impact|keyof typeof grafeas.v1.CVSS.Impact);
+
+            /** CVSS exploitMaturity. */
+            public exploitMaturity: (grafeas.v1.CVSS.ExploitMaturity|keyof typeof grafeas.v1.CVSS.ExploitMaturity);
+
             /**
              * Creates a new CVSS instance using the specified properties.
              * @param [properties] Properties to set
@@ -7157,7 +7205,9 @@ export namespace grafeas {
             enum UserInteraction {
                 USER_INTERACTION_UNSPECIFIED = 0,
                 USER_INTERACTION_NONE = 1,
-                USER_INTERACTION_REQUIRED = 2
+                USER_INTERACTION_REQUIRED = 2,
+                USER_INTERACTION_PASSIVE = 3,
+                USER_INTERACTION_ACTIVE = 4
             }
 
             /** Scope enum. */
@@ -7176,13 +7226,30 @@ export namespace grafeas {
                 IMPACT_PARTIAL = 4,
                 IMPACT_COMPLETE = 5
             }
+
+            /** AttackRequirements enum. */
+            enum AttackRequirements {
+                ATTACK_REQUIREMENTS_UNSPECIFIED = 0,
+                ATTACK_REQUIREMENTS_NONE = 1,
+                ATTACK_REQUIREMENTS_PRESENT = 2
+            }
+
+            /** ExploitMaturity enum. */
+            enum ExploitMaturity {
+                EXPLOIT_MATURITY_UNSPECIFIED = 0,
+                EXPLOIT_MATURITY_NOT_DEFINED = 1,
+                EXPLOIT_MATURITY_ATTACKED = 2,
+                EXPLOIT_MATURITY_POC = 3,
+                EXPLOIT_MATURITY_UNREPORTED = 4
+            }
         }
 
         /** CVSSVersion enum. */
         enum CVSSVersion {
             CVSS_VERSION_UNSPECIFIED = 0,
             CVSS_VERSION_2 = 1,
-            CVSS_VERSION_3 = 2
+            CVSS_VERSION_3 = 2,
+            CVSS_VERSION_4 = 3
         }
 
         /** Properties of a DeploymentNote. */
@@ -14663,6 +14730,9 @@ export namespace grafeas {
 
             /** VulnerabilityNote advisoryPublishTime */
             advisoryPublishTime?: (google.protobuf.ITimestamp|null);
+
+            /** VulnerabilityNote cvssV4 */
+            cvssV4?: (grafeas.v1.ICVSS|null);
         }
 
         /** Represents a VulnerabilityNote. */
@@ -14701,6 +14771,9 @@ export namespace grafeas {
             /** VulnerabilityNote advisoryPublishTime. */
             public advisoryPublishTime?: (google.protobuf.ITimestamp|null);
 
+            /** VulnerabilityNote cvssV4. */
+            public cvssV4?: (grafeas.v1.ICVSS|null);
+
             /**
              * Creates a new VulnerabilityNote instance using the specified properties.
              * @param [properties] Properties to set
@@ -15225,6 +15298,9 @@ export namespace grafeas {
 
             /** VulnerabilityOccurrence risk */
             risk?: (grafeas.v1.IRisk|null);
+
+            /** VulnerabilityOccurrence cvssV4 */
+            cvssV4?: (grafeas.v1.ICVSS|null);
         }
 
         /** Represents a VulnerabilityOccurrence. */
@@ -15281,6 +15357,9 @@ export namespace grafeas {
             /** VulnerabilityOccurrence risk. */
             public risk?: (grafeas.v1.IRisk|null);
 
+            /** VulnerabilityOccurrence cvssV4. */
+            public cvssV4?: (grafeas.v1.ICVSS|null);
+
             /**
              * Creates a new VulnerabilityOccurrence instance using the specified properties.
              * @param [properties] Properties to set