### Problem to solve Vulnerabilities reported by Gemnasium don't have a `severity`. Not only this information is important to users, but it's also very much needed to sort the vulnerabilities in the Security Dashboard. The YAML files of [gemnasium-db](https://gitlab.com/gitlab-org/security-products/gemnasium-db) should contain a `severity` field or a field from which the severity can be calculated, to be propagated by [gemnasium](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium) to the GitLab backend via the Dependency Scanning report. ### Proposal Add CVSS vectors (v2 and v3) to the YAML schema of [gemnasium-db](https://gitlab.com/gitlab-org/security-products/gemnasium-db) and make [gemnasium](https://gitlab.com/gitlab-org/security-products/gemnasium-db) convert these to a severity when generating the report. Both CVSS vectors are optional, and CVSS v3 is preferred. The `severity` of a vulnerability reported by Gemnasium is: - the textual representation of the CVSS v3 base score, if defined - else the textual representation of the CVSS v2 base score, if defined - else `Unknown` ### Implementation plan - [x] In the YAML schema of [gemnasium-db](https://gitlab.com/gitlab-org/security-products/gemnasium-db), add two optional text fields corresponding to the CVSS v2 and v3 vectors; https://gitlab.com/gitlab-org/security-products/gemnasium-db/merge_requests/430/diffs - [x] In adbcurate, collect the CVSS vectors when importing advisories from NVD: https://gitlab.com/gitlab-org/security-products/advisory-db-curation-tools/issues/16 - [x] Update [gemnasium](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium) - [x] update the [`Advisory` Go struct](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium/blob/v2.5.0/advisory/advisory.go) to load the CVSS vectors - [x] parse [`cvss_v2`](https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/a3aede0e48d42860fc307380ec99cf2053db75d0/schema/schema.json#L182) and calculate base score, possibly using https://github.com/umisama/go-cvss - [x] parse [`cvss_v3`](https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/a3aede0e48d42860fc307380ec99cf2053db75d0/schema/schema.json#L192) and calculate base score, possibly using https://github.com/bunji2/cvssv3 - [x] make the [convert](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium/tree/master/convert) package of Gemnasium convert the CVSS vectors into textual value; see section [5. Qualitative Severity Rating Scale](https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale) - [x] release a new version of [gemnasium](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium) - [x] update `gemnasium` dependency in [gemnasium-maven](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven) and release new version - https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/-/merge_requests/47 - https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven/pipelines/136620755 - [x] update `gemnasium` dependency in [gemnasium-python](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-python) and release new version - https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-python/-/merge_requests/53 - https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-python/pipelines/136622500 - [x] update all `gemnasium` test projects - [x] `no_dind-FREEZE` branch - [x] `js-yarn` - https://gitlab.com/gitlab-org/security-products/tests/js-yarn/-/merge_requests/48 - [x] `ruby-bundler` - https://gitlab.com/gitlab-org/security-products/tests/ruby-bundler/-/merge_requests/82 - [x] `ruby-bundler-rails` - https://gitlab.com/gitlab-org/security-products/tests/ruby-bundler-rails/-/merge_requests/23 - [x] `js-npm` - https://gitlab.com/gitlab-org/security-products/tests/js-npm/-/merge_requests/63 - [x] `php-composer` - https://gitlab.com/gitlab-org/security-products/tests/php-composer/-/merge_requests/31 - [x] `master` branch - [x] `js-yarn` - https://gitlab.com/gitlab-org/security-products/tests/js-yarn/-/merge_requests/50 - [x] `ruby-bundler` - https://gitlab.com/gitlab-org/security-products/tests/ruby-bundler/-/merge_requests/90 - [x] `js-npm` - https://gitlab.com/gitlab-org/security-products/tests/js-npm/-/merge_requests/65 - [x] `php-composer` - https://gitlab.com/gitlab-org/security-products/tests/php-composer/-/merge_requests/32 - [x] `ruby-bundler_js-yarn` - https://gitlab.com/gitlab-org/security-products/tests/ruby-bundler_js-yarn/-/merge_requests/13 - [x] `ruby-bundler-rails` - https://gitlab.com/gitlab-org/security-products/tests/ruby-bundler-rails/-/merge_requests/20 - [x] `go-modules` - https://gitlab.com/gitlab-org/security-products/tests/go-modules/-/merge_requests/25 - [x] update all `gemnasium-maven` test projects - [x] `no_dind-FREEZE` branch - [x] `java-maven` - https://gitlab.com/gitlab-org/security-products/tests/java-maven/-/merge_requests/63 - [x] `scala-sbt` - https://gitlab.com/gitlab-org/security-products/tests/scala-sbt/-/merge_requests/16 - [x] `java-gradle` - https://gitlab.com/gitlab-org/security-products/tests/java-gradle/-/merge_requests/19 - [x] `java-gradle-multimodules` - https://gitlab.com/gitlab-org/security-products/tests/java-gradle-multimodules/-/merge_requests/7 - [x] `java-maven-multimodules` - https://gitlab.com/gitlab-org/security-products/tests/java-maven-multimodules/-/merge_requests/40 - [x] `master` branch - [x] `java-maven` - https://gitlab.com/gitlab-org/security-products/tests/java-maven/-/merge_requests/64 - [x] `scala-sbt` - https://gitlab.com/gitlab-org/security-products/tests/scala-sbt/-/merge_requests/17 - [x] `java-gradle` - https://gitlab.com/gitlab-org/security-products/tests/java-gradle/-/merge_requests/20 - [x] `java-gradle-multimodules` - https://gitlab.com/gitlab-org/security-products/tests/java-gradle-multimodules/-/merge_requests/8 - [x] `java-maven-multimodules` - https://gitlab.com/gitlab-org/security-products/tests/java-maven-multimodules/-/merge_requests/44 - [x] update all `gemnasium-python` test projects - [x] `no_dind-FREEZE` branch - [x] `python-pip` - https://gitlab.com/gitlab-org/security-products/tests/python-pip/-/merge_requests/81 - [x] `python-pipenv` - https://gitlab.com/gitlab-org/security-products/tests/python-pipenv/-/merge_requests/29 - [x] `master` branch - [x] `python-pip` - https://gitlab.com/gitlab-org/security-products/tests/python-pip/-/merge_requests/88 - [x] `python-pipenv` - https://gitlab.com/gitlab-org/security-products/tests/python-pipenv/-/merge_requests/30 ## Release Post - [https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_requests/45357](https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_requests/45357) <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION --> *This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.* <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION -->