cvss_rescore
Rescore cvss3 and 3.1 results from any json file based on custom rules.
The Problem
Cvss scoring consists of three components: Base, Temporal, and Environmental.
When working with third-party dependency (SCA) vulnerabilities, nearly every tool reports it’s scores only using the base score. This is understandable, as the reporters of the vulnerabilities would only know about the vulnerabilities themselves. They would have no idea how the vulnerable package is actually used in your project. Do you have mitigating controls in place? Is it only a test project? Is it only in a protected CI/CD pipeline? All of these factors and more can impact the environmental score, which can lower the actual score of a vulnerability significantly.
How We Use This
Output-Agnostic
We use the cvss-rescore packate as a post-processor after our SCA scan has been run. Because the cvss-rescore package can take any json format output, it is tool-agnostic. We have tested it successfully using Dependabot and JFrog Xray, but there’s no reason any other tool can’t be used so long as the output is json.
Rules-Based
Because we leverage the Python rule-engine package as a dependency, users can create a rules_actions.json file in their root directory. Users can create as many rules as they need, modifying one or more cvss vector metrics per rule.
Requirements
Python 3.6 or higher
A working knowledge of CVSS calcuation. You can reference the calculator at
Installation
You can find the package at pypi.org https://pypi.org/project/cvss-rescore/
To install, simply run ‘pip install cvss-rescore’ from the command line
Documentation
You can get the current documentation at https://cvss-rescore.readthedocs.io/en/latest/
Dependencies
Note
This project has been set up using PyScaffold 4.3.1. For details and usage information on PyScaffold see https://pyscaffold.org/.
1 maintainer
Metadata
1 maintainer
Release files for cvss-rescore 0.0.5
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| cvss_rescore-0.0.5.tar.gz | 28.7 kB | Without provenance | Details for cvss_rescore-0.0.5.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| cvss_rescore-0.0.5-py3-none-any.whl | Python 3 | none | any | Details for cvss_rescore-0.0.5-py3-none-any.whl |
Total release size: 34.6 kB
Release files / cvss_rescore-0.0.5.tar.gz
| Download URL | cvss_rescore-0.0.5.tar.gz |
|---|---|
| Size | 28.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
9f48f94d75572996771fdcf66abfe1c160dbd7f37b79b58ba30dee4ebded3a50
|
|
BLAKE2b-256 checksum How to use checksums |
5ff43103bbe844b01c29915e29af687cd24ba92bceb96a90bd50978ab3e7f26f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.9.5
|
Release files / cvss_rescore-0.0.5-py3-none-any.whl
| Download URL | cvss_rescore-0.0.5-py3-none-any.whl |
|---|---|
| Size | 5.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
7133b69383f09e860069bb4127c7a481bcaaa6fac6ca5be6feaf8c7339d40aaf
|
|
BLAKE2b-256 checksum How to use checksums |
134ae1f5fb369fcc47ac8a74cfb5c908aa088db32544242e6d2d83528aeda38c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.9.5
|
Security for cvss-rescore 0.0.5
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
