Skip to content

Commit d402a12

Browse files
vmayoralvmayoral
committed
Implement Age (Y)
1 parent 004c027 commit d402a12

File tree

6 files changed

+97
-13
lines changed

6 files changed

+97
-13
lines changed

‎cvsslib/base_enum.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@ def get_value_from_vector_key(cls, key):
8383
vector_override = cls._vectors.value
8484

8585
if key in vector_override:
86+
# print(getattr(cls, vector_override[key]))
8687
return getattr(cls, vector_override[key])
8788

8889
# print(cls.members())

‎cvsslib/cvss3/calculations.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ def calculate_modified_exploitability_sub_score(vector: ModifiedAttackVector,
2626
complexity: ModifiedAttackComplexity,
2727
privilege: ModifiedPrivilegesRequired,
2828
interaction: ModifiedUserInteraction):
29+
# print("modified complexity: " + str(complexity))
30+
# print("modified privilege: " + str(privilege))
31+
# print("modified interaction: " + str(interaction))
2932
return EXPLOITABILITY_COEFFECIENT * vector * complexity * privilege * interaction
3033

3134

‎cvsslib/example_vectors.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,13 @@
6262
("AV:N/AC:L/Au:N/C:C/I:C/A:C", (10, None, None))
6363
]
6464

65+
# TODO update
6566
rvss_vectors = [
6667
("RVSS:1.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N", (5.8, 5.8, 7.1)),
6768
# ("RVSS:1.0/AV:RN/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N", (5.8, 5.8, 7.1)),
6869
]
6970

71+
# TODO update
7072
rvss_comparison_vectors = [
7173
("AV:N/AC:L/Au:N/C:C/I:C/A:C", "AV:N/AC:L/Au:N/C:C/I:C/A:C", (10, None, None))
7274
]

‎cvsslib/rvss/calculations.py

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,34 @@ def roundup(num):
1717
def calculate_exploitability_sub_score(attack_vector: AttackVector,
1818
complexity: AttackComplexity,
1919
privilege: PrivilegeRequired,
20-
interaction: UserInteraction):
21-
return EXPLOITABILITY_COEFFECIENT * attack_vector * complexity * privilege * interaction
20+
interaction: UserInteraction,
21+
age:Age):
22+
# print("age: " + str(age))
23+
return EXPLOITABILITY_COEFFECIENT * attack_vector * complexity * privilege * interaction * age
24+
25+
# def calculate_exploitability_sub_score(attack_vector: AttackVector,
26+
# complexity: AttackComplexity,
27+
# privilege: PrivilegeRequired,
28+
# interaction: UserInteraction):
29+
# return EXPLOITABILITY_COEFFECIENT * attack_vector * complexity * privilege * interaction
2230

2331

2432
def calculate_modified_exploitability_sub_score(vector: ModifiedAttackVector,
2533
complexity: ModifiedAttackComplexity,
2634
privilege: ModifiedPrivilegesRequired,
27-
interaction: ModifiedUserInteraction):
28-
return EXPLOITABILITY_COEFFECIENT * vector * complexity * privilege * interaction
35+
interaction: ModifiedUserInteraction,
36+
age: ModifiedAge):
37+
# print("modified complexity: " + str(complexity))
38+
# print("modified privilege: " + str(privilege))
39+
# print("modified interaction: " + str(interaction))
40+
# print("modified age: " + str(age))
41+
return EXPLOITABILITY_COEFFECIENT * vector * complexity * privilege * interaction * age
42+
43+
# def calculate_modified_exploitability_sub_score(vector: ModifiedAttackVector,
44+
# complexity: ModifiedAttackComplexity,
45+
# privilege: ModifiedPrivilegesRequired,
46+
# interaction: ModifiedUserInteraction):
47+
# return EXPLOITABILITY_COEFFECIENT * vector * complexity * privilege * interaction
2948

3049

3150
def calculate_impact_sub_score(scope: Scope,

‎cvsslib/rvss/enums.py

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,22 @@ class UserInteraction(BaseEnum):
9191
NONE = D("0.85")
9292
REQUIRED = D("0.62")
9393

94+
class Age(BaseEnum):
95+
"""
96+
Vector: Y
97+
Mandatory: yes
98+
"""
99+
YEAR1 = D("1.5")
100+
YEARS3 = D("1.2")
101+
MORE3YEARS = D("1.0")
102+
UNKNOWN = D("1.0")
103+
104+
_vectors = {
105+
"1": "YEAR1",
106+
"3": "YEARS3",
107+
"O": "MORE3YEARS",
108+
"U": "1YEAR",
109+
}
94110

95111
class Scope(BaseEnum):
96112
"""
@@ -208,6 +224,9 @@ class AvailabilityRequirement(BaseEnum):
208224
ModifiedUserInteraction = UserInteraction.extend("ModifiedUserInteraction", {"NOT_DEFINED": NotDefined()},
209225
"Vector: MUI")
210226

227+
ModifiedAge = Age.extend("ModifiedAge", {"NOT_DEFINED": NotDefined()},
228+
"Vector: MY")
229+
211230
ModifiedScope = Scope.extend("ModifiedScope", {"NOT_DEFINED": NotDefined()}, "Vector: MS")
212231

213232
ModifiedConfidentialityImpact = ConfidentialityImpact.extend("ModifiedConfidentialityImpact",
@@ -220,7 +239,7 @@ class AvailabilityRequirement(BaseEnum):
220239

221240
OPTIONAL_VALUES = {
222241
ModifiedAttackVector, ModifiedAttackComplexity, ModifiedPrivilegesRequired,
223-
ModifiedUserInteraction, ModifiedScope, ModifiedConfidentialityImpact,
242+
ModifiedUserInteraction, ModifiedAge, ModifiedScope, ModifiedConfidentialityImpact,
224243
ModifiedIntegrityImpact, ModifiedAvailabilityImpact
225244
}
226245

@@ -229,6 +248,7 @@ class AvailabilityRequirement(BaseEnum):
229248
AttackComplexity,
230249
PrivilegeRequired,
231250
UserInteraction,
251+
Age,
232252

233253
Scope,
234254
ConfidentialityImpact,
@@ -247,6 +267,7 @@ class AvailabilityRequirement(BaseEnum):
247267
ModifiedAttackComplexity,
248268
ModifiedPrivilegesRequired,
249269
ModifiedUserInteraction,
270+
ModifiedAge,
250271
ModifiedScope,
251272

252273
ModifiedConfidentialityImpact,

‎tests/test_rvss.py

Lines changed: 46 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,31 @@
66
# TODO: bring this vector to "example_vectors.py" file
77
rvss_vectors = [
88
# Various tests for the attack vector (AV)
9-
("RVSS:1.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N", (5.8, 5.8, 7.1)),
10-
("RVSS:1.0/AV:RN/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N", (6.1, 6.1, 8.1)),
11-
("RVSS:1.0/AV:AN/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N", (5.9, 5.9, 7.3)),
12-
("RVSS:1.0/AV:PP/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N", (5.9, 5.9, 7.3)),
13-
("RVSS:1.0/AV:PI/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N", (5.4, 5.4, 5.9)),
9+
("RVSS:1.0/AV:L/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N", (5.8, 5.8, 7.1)),
10+
("RVSS:1.0/AV:RN/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N", (6.1, 6.1, 8.1)),
11+
("RVSS:1.0/AV:AN/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N", (5.9, 5.9, 7.3)),
12+
("RVSS:1.0/AV:PP/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N", (5.9, 5.9, 7.3)),
13+
("RVSS:1.0/AV:PI/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N", (5.4, 5.4, 5.9)),
1414
# AV combinations
15-
("RVSS:1.0/AV:ANPR/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N", (5.5, 5.5, 6.1)),
16-
("RVSS:1.0/AV:PPL/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N", (5.6, 5.6, 6.4)),
15+
("RVSS:1.0/AV:ANPR/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N", (5.5, 5.5, 6.1)),
16+
("RVSS:1.0/AV:PPL/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N", (5.6, 5.6, 6.4)),
17+
# Age tests
18+
("RVSS:1.0/AV:L/AC:L/PR:H/UI:R/Y:3/S:U/C:H/I:N/A:H/MPR:N", (5.9, 5.9, 7.4)),
19+
("RVSS:1.0/AV:L/AC:L/PR:H/UI:R/Y:1/S:U/C:H/I:N/A:H/MPR:N", (6.1, 6.1, 8.0)),
20+
]
21+
22+
test_rvss_vectors = [
23+
("RVSS:1.0/AV:PI/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N"),
24+
("RVSS:1.0/AV:ANPR/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N"),
25+
("RVSS:1.0/AV:PPL/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N"),
26+
("RVSS:1.0/AV:L/AC:L/PR:H/UI:R/Y:3/S:U/C:H/I:N/A:H/MPR:N"),
27+
("RVSS:1.0/AV:L/AC:L/PR:H/UI:R/Y:1/S:U/C:H/I:N/A:H/MPR:N"),
28+
]
29+
30+
rvss_comparison_vectors = [
31+
("CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N",
32+
"RVSS:1.0/AV:L/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N",
33+
(5.8, 5.8, 7.1)),
1734
]
1835

1936
def test_v3_vectors():
@@ -30,13 +47,34 @@ def test_rvss_vectors():
3047
# print(results)
3148
assert results == score, "Vector {0} failed".format(vector)
3249

50+
def comparison_rvss_vectors():
51+
for vector1, vector2, results in rvss_comparison_vectors:
52+
score1 = calculate_vector(vector1, cvss3)
53+
score2 = calculate_vector(vector2, rvss)
54+
# print(score)
55+
# print(results)
56+
assert results == score1, "Vector {0} failed".format(vector1)
57+
assert results == score2, "Vector {0} failed".format(vector2)
58+
assert score1 == score2, "CVSS and RVSS vectors' score don't match "
59+
3360

61+
## Run tests
3462
# test_v3_vectors()
35-
# test_rvss_vectors()
63+
test_rvss_vectors()
64+
comparison_rvss_vectors()
3665

3766
###########
3867
## Individual tests
3968
###########
4069

4170
# vector_v3 = "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H/MPR:N"
4271
# print(calculate_vector(vector_v3, cvss3))
72+
#
73+
# vector_rvss = "RVSS:1.0/AV:L/AC:L/PR:H/UI:R/Y:U/S:U/C:H/I:N/A:H/MPR:N"
74+
# print(calculate_vector(vector_rvss, rvss))
75+
#
76+
# vector_rvss = "RVSS:1.0/AV:L/AC:L/PR:H/UI:R/Y:3/S:U/C:H/I:N/A:H/MPR:N"
77+
# print(calculate_vector(vector_rvss, rvss))
78+
#
79+
# vector_rvss = "RVSS:1.0/AV:L/AC:L/PR:H/UI:R/Y:1/S:U/C:H/I:N/A:H/MPR:N"
80+
# print(calculate_vector(vector_rvss, rvss))

0 commit comments

Comments
 (0)