Skip to content

Provide Severity levels for vulnerabilities found by Gemnasium

Problem to solve

Vulnerabilities reported by Gemnasium don't have a severity. Not only this information is important to users, but it's also very much needed to sort the vulnerabilities in the Security Dashboard.

The YAML files of gemnasium-db should contain a severity field or a field from which the severity can be calculated, to be propagated by gemnasium to the GitLab backend via the Dependency Scanning report.

Proposal

Add CVSS vectors (v2 and v3) to the YAML schema of gemnasium-db and make gemnasium convert these to a severity when generating the report.

Both CVSS vectors are optional, and CVSS v3 is preferred.

The severity of a vulnerability reported by Gemnasium is:

  • the textual representation of the CVSS v3 base score, if defined
  • else the textual representation of the CVSS v2 base score, if defined
  • else Unknown

Implementation plan

Release Post

This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.

Edited by 🤖 GitLab Bot 🤖