owasp-depscan 5.4.8__py3-none-any.whl → 5.5.0__py3-none-any.whl

depscan/lib/analysis.py

@@ -19,7 +19,7 @@ from rich.table import Table
 from rich.tree import Tree
 from vdb.lib import CPE_FULL_REGEX
 from vdb.lib.config import placeholder_exclude_version, placeholder_fix_version
-from vdb.lib.utils import parse_cpe, parse_purl
+from vdb.lib.utils import get_cvss3_from_vector, get_cvss4_from_vector, parse_cpe, parse_purl
 
 from depscan.lib import config
 from depscan.lib.logger import LOG, console
@@ -336,6 +336,11 @@ def prepare_vdr(options: PrepareVdrOptions):
             justify = "right"
         table.add_column(header=h, justify=justify, vertical="top")
     for vuln_occ_dict in options.results:
+        # If CVSS v4 data is available, override the severity and cvss_score
+        if vuln_occ_dict.get("cvss4_vector_string"):
+            cvss4_obj = get_cvss4_from_vector(vuln_occ_dict.get("cvss4_vector_string"))
+            vuln_occ_dict["cvss_score"] = cvss4_obj.get("baseScore")
+            vuln_occ_dict["severity"] = cvss4_obj.get("baseSeverity").upper()
         vid = vuln_occ_dict.get("id")
         problem_type = vuln_occ_dict.get("problem_type")
         cwes = []
@@ -1026,34 +1031,33 @@ def cvss_to_vdr_rating(vuln_occ_dict):
 
     :return: A list containing a dictionary with CVSS score information.
     """
-    cvss_score = vuln_occ_dict.get("cvss_score", 2.0)
-    with contextlib.suppress(ValueError, TypeError):
-        cvss_score = float(cvss_score)
-    if (pkg_severity := vuln_occ_dict.get("severity", "").lower()) not in (
-        "critical",
-        "high",
-        "medium",
-        "low",
-        "info",
-        "none",
-    ):
-        pkg_severity = "unknown"
-    ratings = [
-        {
-            "score": cvss_score,
-            "severity": pkg_severity,
-        }
-    ]
-    method = "31"
+    ratings = []
+    # Support for cvss v4
+    if vuln_occ_dict.get("cvss4_vector_string") and (vector_string := vuln_occ_dict.get("cvss4_vector_string")):
+        cvss4_obj = get_cvss4_from_vector(vector_string)
+        ratings.append(
+            {
+                "method": "CVSSv4",
+                "score": cvss4_obj.get("baseScore"),
+                "severity": cvss4_obj.get("baseSeverity").lower(),
+                "vector": vector_string
+            }
+        )
     if vuln_occ_dict.get("cvss_v3") and (
         vector_string := vuln_occ_dict["cvss_v3"].get("vector_string")
     ):
-        ratings[0]["vector"] = vector_string
         with contextlib.suppress(CVSSError):
-            method = cvss.CVSS3(vector_string).as_json().get("version")
+            cvss3_obj = get_cvss3_from_vector(vector_string)
+            method = cvss3_obj.get("version")
             method = method.replace(".", "").replace("0", "")
-    ratings[0]["method"] = f"CVSSv{method}"
-
+            ratings.append(
+                {
+                    "method": f"CVSSv{method}",
+                    "score": cvss3_obj.get("baseScore"),
+                    "severity": cvss3_obj.get("baseSeverity").lower(),
+                    "vector": vector_string
+                }
+            )
     return ratings
 
 

{owasp_depscan-5.4.8.dist-info → owasp_depscan-5.5.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.4.8
+Version: 5.5.0
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db==5.7.8
+Requires-Dist: appthreat-vulnerability-db==5.8.1
 Requires-Dist: defusedxml
 Requires-Dist: oras~=0.1.26
 Requires-Dist: PyYAML

{owasp_depscan-5.4.8.dist-info → owasp_depscan-5.5.0.dist-info}/RECORD

@@ -1,7 +1,7 @@
 depscan/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 depscan/cli.py,sha256=WQ_EbQgkwW0h1L-7otvaG8mLFqpk4r8n8YCPjHcCE1M,39240
 depscan/lib/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-depscan/lib/analysis.py,sha256=M3xvQbsN3-__3OXCsLD2MJYOcpVzUKyjmWoO6xL1T8I,60473
+depscan/lib/analysis.py,sha256=CxAlqEyiYrJiFWyhgqyWVzPoCmjfwZVpgF1znFnsjVE,61104
 depscan/lib/audit.py,sha256=wpmIowFLaoFs0agZN3FUFxPumty5Gr6YRfcjXGsuNcI,1497
 depscan/lib/bom.py,sha256=MuHBCAt0tQ7LKwuDyMlxi0yCrMA6jI7tV81bFslU3S4,16822
 depscan/lib/config.py,sha256=l5HNXZVUlY7aLjBtVn8jvZVZIeN-YOg5t2E5qmTuKsY,15206
@@ -66,9 +66,9 @@ vendor/choosealicense.com/_licenses/vim.txt,sha256=d5GQjXB328L8EBkhKgxcjk344D3K7
 vendor/choosealicense.com/_licenses/wtfpl.txt,sha256=BxXeubkvQm32MDmlZsBcbzJzBpR5kWgw0JxSR9d7f3k,948
 vendor/choosealicense.com/_licenses/zlib.txt,sha256=e6dfCeLhxD3NCnIkY4cVIagRaWdRvencjNhHZ1APvpc,1678
 vendor/spdx/json/licenses.json,sha256=smNvDARyOEm37C5Xxqyv8-qkvoxGRACoUVNbUaSb4F8,305885
-owasp_depscan-5.4.8.dist-info/LICENSE,sha256=oQnCbnZtJ_NLDdOLc-rVY1D1N0RNWLHPpYXcc77xzSo,1073
-owasp_depscan-5.4.8.dist-info/METADATA,sha256=bRhTTwUkoezH2PlZ_DE12n4jqfuRVuyvxf9Bb7tJ4cU,38300
-owasp_depscan-5.4.8.dist-info/WHEEL,sha256=OVMc5UfuAQiSplgO0_WdW7vXVGAt9Hdd6qtN4HotdyA,91
-owasp_depscan-5.4.8.dist-info/entry_points.txt,sha256=FxQKHFWZTfKU2eBxHPFRxwhSNexntYygYhquykS8zxA,69
-owasp_depscan-5.4.8.dist-info/top_level.txt,sha256=qbHOZvNU2dXANv946hMdP2vOi0ESQB5t2ZY5ktKtXvQ,15
-owasp_depscan-5.4.8.dist-info/RECORD,,
+owasp_depscan-5.5.0.dist-info/LICENSE,sha256=oQnCbnZtJ_NLDdOLc-rVY1D1N0RNWLHPpYXcc77xzSo,1073
+owasp_depscan-5.5.0.dist-info/METADATA,sha256=nCvNzb5ypzWLVkoI2JR9aq9rY6p8P_NbBT_QJJraZDM,38300
+owasp_depscan-5.5.0.dist-info/WHEEL,sha256=P9jw-gEje8ByB7_hXoICnHtVCrEwMQh-630tKvQWehc,91
+owasp_depscan-5.5.0.dist-info/entry_points.txt,sha256=FxQKHFWZTfKU2eBxHPFRxwhSNexntYygYhquykS8zxA,69
+owasp_depscan-5.5.0.dist-info/top_level.txt,sha256=qbHOZvNU2dXANv946hMdP2vOi0ESQB5t2ZY5ktKtXvQ,15
+owasp_depscan-5.5.0.dist-info/RECORD,,

{owasp_depscan-5.4.8.dist-info → owasp_depscan-5.5.0.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (75.2.0)
+Generator: setuptools (75.3.0)
 Root-Is-Purelib: true
 Tag: py3-none-any