Merge pull request #696 from tschmidtb51/add-cvss-4.0

Correct CVSS 4.0
oasis-tcs · Feb 26, 2024 · 3061721 · 3061721
2 parents 469fba2 + 949834b
commit 3061721
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 11 deletions.
diff --git a/csaf_2.1/referenced_schema/first/cvss-v4.0.json b/csaf_2.1/referenced_schema/first/cvss-v4.0.json
@@ -23,7 +23,7 @@
 
   "$schema": "http://json-schema.org/draft-07/schema#",
   "title": "JSON Schema for Common Vulnerability Scoring System version 4.0",
-  "$id": "https://www.first.org/cvss/cvss-v4.0.json?20231011",
+  "$id": "https://www.first.org/cvss/cvss-v4.0.json?20240216",
   "type": "object",
   "definitions": {
       "attackVectorType": {
@@ -86,12 +86,12 @@
       },
       "modifiedSubCType": {
           "type": "string",
-          "enum": [ "NONE", "LOW", "HIGH", "NOT_DEFINED" ],
+          "enum": [ "NEGLIGIBLE", "LOW", "HIGH", "NOT_DEFINED" ],
           "default": "NOT_DEFINED"
       },
       "modifiedSubIaType": {
           "type": "string",
-          "enum": [ "NONE", "LOW", "HIGH", "SAFETY", "NOT_DEFINED" ],
+          "enum": [ "NEGLIGIBLE", "LOW", "HIGH", "SAFETY", "NOT_DEFINED" ],
           "default": "NOT_DEFINED"
       },
       "exploitMaturityType": {

diff --git a/csaf_2.1/referenced_schema/first/cvss-v4.0_strict.json b/csaf_2.1/referenced_schema/first/cvss-v4.0_strict.json
@@ -1,5 +1,5 @@
 {
-  "$id": "https://www.first.org/cvss/cvss-v4.0.json?20231011",
+  "$id": "https://www.first.org/cvss/cvss-v4.0.json?20240216",
   "$schema": "http://json-schema.org/draft-07/schema#",
   "unevaluatedProperties": false,
   "allOf": [
@@ -297,7 +297,7 @@
     "modifiedSubCType": {
       "default": "NOT_DEFINED",
       "enum": [
-        "NONE",
+        "NEGLIGIBLE",
         "LOW",
         "HIGH",
         "NOT_DEFINED"
@@ -307,7 +307,7 @@
     "modifiedSubIaType": {
       "default": "NOT_DEFINED",
       "enum": [
-        "NONE",
+        "NEGLIGIBLE",
         "LOW",
         "HIGH",
         "SAFETY",

diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-08.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-08.json
@@ -46,8 +46,8 @@
             "modifiedVulnConfidentialityImpact": "NONE",
             "modifiedVulnIntegrityImpact": "NONE",
             "modifiedVulnAvailabilityImpact": "NONE",
-            "modifiedSubConfidentialityImpact": "NONE",
-            "modifiedSubIntegrityImpact": "NONE",
+            "modifiedSubConfidentialityImpact": "NEGLIGIBLE",
+            "modifiedSubIntegrityImpact": "NEGLIGIBLE",
             "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
             "version": "4.0"
           },

diff --git a/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-19.json b/csaf_2.1/test/validator/data/optional/oasis_csaf_tc-csaf_2_1-2024-6-2-19-19.json
@@ -46,9 +46,9 @@
             "modifiedVulnConfidentialityImpact": "NONE",
             "modifiedVulnIntegrityImpact": "NONE",
             "modifiedVulnAvailabilityImpact": "NONE",
-            "modifiedSubConfidentialityImpact": "NONE",
-            "modifiedSubIntegrityImpact": "NONE",
-            "modifiedSubAvailabilityImpact": "NONE",
+            "modifiedSubConfidentialityImpact": "NEGLIGIBLE",
+            "modifiedSubIntegrityImpact": "NEGLIGIBLE",
+            "modifiedSubAvailabilityImpact": "NEGLIGIBLE",
             "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
             "version": "4.0"
           },