@google-cloud/containeranalysis 6.8.0 → 7.0.0

package/build/protos/grafeas/v1/cvss.proto

@@ -100,70 +100,165 @@ message CVSS {
   // Base Metrics
   // Represents the intrinsic characteristics of a vulnerability that are
   // constant over time and across user environments.
+
+  // Attack Vector (AV). Defined in CVSS v2, v3, v4.
   AttackVector attack_vector = 4;
+  // Attack Complexity (AC). Defined in CVSS v2, v3, v4.
   AttackComplexity attack_complexity = 5;
+  // Authentication (Au). Defined in CVSS v2.
   Authentication authentication = 6;
+  // Privileges Required (PR). Defined in CVSS v3, v4.
   PrivilegesRequired privileges_required = 7;
+  // User Interaction (UI). Defined in CVSS v3, v4.
   UserInteraction user_interaction = 8;
+  // Scope (S). Defined in CVSS v3.
   Scope scope = 9;
+  // Confidentiality Impact (C). Defined in CVSS v2, v3.
   Impact confidentiality_impact = 10;
+  // Integrity Impact (I). Defined in CVSS v2, v3.
   Impact integrity_impact = 11;
+  // Availability Impact (A). Defined in CVSS v2, v3.
   Impact availability_impact = 12;
+  // Attack Requirements (AT). Defined in CVSS v4.
+  AttackRequirements attack_requirements = 13;
+  // Vulnerable System Confidentiality Impact (VC). Defined in CVSS v4.
+  Impact vulnerable_system_confidentiality_impact = 14;
+  // Vulnerable System Integrity Impact (VI). Defined in CVSS v4.
+  Impact vulnerable_system_integrity_impact = 15;
+  // Vulnerable System Availability Impact (VA). Defined in CVSS v4.
+  Impact vulnerable_system_availability_impact = 16;
+  // Subsequent System Confidentiality Impact (SC). Defined in CVSS v4.
+  Impact subsequent_system_confidentiality_impact = 17;
+  // Subsequent System Integrity Impact (SI). Defined in CVSS v4.
+  Impact subsequent_system_integrity_impact = 18;
+  // Subsequent System Availability Impact (SA). Defined in CVSS v4.
+  Impact subsequent_system_availability_impact = 19;
+  // Exploit Maturity (E). Defined in CVSS v4.
+  ExploitMaturity exploit_maturity = 20;
 
+  // Attack Vector.
   enum AttackVector {
+    // Unspecified.
     ATTACK_VECTOR_UNSPECIFIED = 0;
+    // Attack Vector: Network (AV:N). Defined in CVSS v2, v3, v4.
     ATTACK_VECTOR_NETWORK = 1;
+    // Attack Vector: Adjacent (AV:A). Defined in CVSS v2, v3, v4.
     ATTACK_VECTOR_ADJACENT = 2;
+    //  Attack Vector: Local (AV:L). Defined in CVSS v2, v3, v4.
     ATTACK_VECTOR_LOCAL = 3;
+    // Attack Vector: Physical (AV:P). Defined in CVSS v3, v4.
     ATTACK_VECTOR_PHYSICAL = 4;
   }
 
+  // Attack Complexity.
   enum AttackComplexity {
+    // Unspecified.
     ATTACK_COMPLEXITY_UNSPECIFIED = 0;
+    // Low attack complexity (AC:L). Defined in CVSS v2, v3, v4.
     ATTACK_COMPLEXITY_LOW = 1;
+    // High attack complexity (AC:H). Defined in CVSS v2, v3, v4.
     ATTACK_COMPLEXITY_HIGH = 2;
+    // Medium attack complexity (AC:M). Defined in CVSS v2.
     ATTACK_COMPLEXITY_MEDIUM = 3;
   }
 
+  // Authentication.
   enum Authentication {
+    // Unspecified.
     AUTHENTICATION_UNSPECIFIED = 0;
+    // Multiple authentication required (Au:M). Defined in CVSS v2.
     AUTHENTICATION_MULTIPLE = 1;
+    // Single authentication required (Au:S). Defined in CVSS v2.
     AUTHENTICATION_SINGLE = 2;
+    // No authentication required (Au:N). Defined in CVSS v2.
     AUTHENTICATION_NONE = 3;
   }
 
+  // Privileges Required.
   enum PrivilegesRequired {
+    // Unspecified.
     PRIVILEGES_REQUIRED_UNSPECIFIED = 0;
+    // No privileges required (PR:N). Defined in CVSS v3, v4.
     PRIVILEGES_REQUIRED_NONE = 1;
+    // Low privileges required (PR:L). Defined in CVSS v3, v4.
     PRIVILEGES_REQUIRED_LOW = 2;
+    // High privileges required (PR:H). Defined in CVSS v3, v4.
     PRIVILEGES_REQUIRED_HIGH = 3;
   }
 
+  // User Interaction.
   enum UserInteraction {
+    // Unspecified.
     USER_INTERACTION_UNSPECIFIED = 0;
+    // No user interaction required (UI:N). Defined in CVSS v3, v4.
     USER_INTERACTION_NONE = 1;
+    // User interaction required (UI:R). Defined in CVSS v3.
     USER_INTERACTION_REQUIRED = 2;
+    // Passive user interaction required (UI:P). Defined in CVSS v4.
+    USER_INTERACTION_PASSIVE = 3;
+    // Active user interaction required (UI:A). Defined in CVSS v4.
+    USER_INTERACTION_ACTIVE = 4;
   }
 
+  // Scope.
   enum Scope {
+    // Unspecified.
     SCOPE_UNSPECIFIED = 0;
+    // Scope: Unchanged (S:U). Defined in CVSS v3.
     SCOPE_UNCHANGED = 1;
+    // Scope: Changed (S:C). Defined in CVSS v3.
     SCOPE_CHANGED = 2;
   }
 
+  // Impact.
   enum Impact {
+    // Unspecified.
     IMPACT_UNSPECIFIED = 0;
+    // High impact (H). Defined in CVSS v3, v4.
     IMPACT_HIGH = 1;
+    // Low impact (L). Defined in CVSS v3, v4.
     IMPACT_LOW = 2;
+    // No impact (N). Defined in CVSS v2, v3, v4.
     IMPACT_NONE = 3;
+    // Partial impact (P). Defined in CVSS v2.
     IMPACT_PARTIAL = 4;
+    // Complete impact (C). Defined in CVSS v2.
     IMPACT_COMPLETE = 5;
   }
+
+  // Attack Requirements.
+  enum AttackRequirements {
+    // Unspecified.
+    ATTACK_REQUIREMENTS_UNSPECIFIED = 0;
+    // No attack requirements (AT:N). Defined in CVSS v4.
+    ATTACK_REQUIREMENTS_NONE = 1;
+    // Attack requirements: Present (AT:P). Defined in CVSS v4.
+    ATTACK_REQUIREMENTS_PRESENT = 2;
+  }
+
+  // Exploit Maturity (E). Defined in CVSS v4.
+  enum ExploitMaturity {
+    // Unspecified.
+    EXPLOIT_MATURITY_UNSPECIFIED = 0;
+    // Exploit maturity: Not defined (E:X). Defined in CVSS v4.
+    EXPLOIT_MATURITY_NOT_DEFINED = 1;
+    // Exploit maturity: Attacked (E:A). Defined in CVSS v4.
+    EXPLOIT_MATURITY_ATTACKED = 2;
+    // Exploit maturity: Proof-of-concept (E:P). Defined in CVSS v4.
+    EXPLOIT_MATURITY_POC = 3;
+    // Exploit maturity: Unreported (E:U). Defined in CVSS v4.
+    EXPLOIT_MATURITY_UNREPORTED = 4;
+  }
 }
 
 // CVSS Version.
 enum CVSSVersion {
+  // Unspecified.
   CVSS_VERSION_UNSPECIFIED = 0;
+  // CVSS v2.
   CVSS_VERSION_2 = 1;
+  // CVSS v3.
   CVSS_VERSION_3 = 2;
+  // CVSS v4.
+  CVSS_VERSION_4 = 3;
 }

package/build/protos/grafeas/v1/vulnerability.proto

@@ -160,7 +160,10 @@ message VulnerabilityNote {
   // The time this advisory was published by the source.
   google.protobuf.Timestamp advisory_publish_time = 9;
 
-  // Next free ID is 10.
+  // The full description of the v4 CVSS for this vulnerability.
+  CVSS cvss_v4 = 10;
+
+  // Next free ID is 11.
 }
 
 // An occurrence of a severity vulnerability on a resource.
@@ -308,5 +311,8 @@ message VulnerabilityOccurrence {
   // Risk information about the vulnerability, such as CISA, EPSS, etc.
   Risk risk = 15;
 
-  // Next free ID is 16.
+  // The cvss v4 score for the vulnerability.
+  CVSS cvss_v4 = 16;
+
+  // Next free ID is 17.
 }