diff --git a/bindings/go/osvschema/vulnerability.pb.go b/bindings/go/osvschema/vulnerability.pb.go index a7623e09..f5721550 100644 --- a/bindings/go/osvschema/vulnerability.pb.go +++ b/bindings/go/osvschema/vulnerability.pb.go @@ -14,8 +14,8 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.10 -// protoc v6.33.0 +// protoc-gen-go v1.36.11 +// protoc v7.35.0 // source: vulnerability.proto package osvschema @@ -193,6 +193,59 @@ func (Severity_Type) EnumDescriptor() ([]byte, []int) { return file_vulnerability_proto_rawDescGZIP(), []int{5, 0} } +// Source of the severity. +type Severity_Source int32 + +const ( + Severity_SOURCE_UNSPECIFIED Severity_Source = 0 + Severity_NVD Severity_Source = 1 + Severity_CNA Severity_Source = 2 + Severity_SELF Severity_Source = 3 +) + +// Enum value maps for Severity_Source. +var ( + Severity_Source_name = map[int32]string{ + 0: "SOURCE_UNSPECIFIED", + 1: "NVD", + 2: "CNA", + 3: "SELF", + } + Severity_Source_value = map[string]int32{ + "SOURCE_UNSPECIFIED": 0, + "NVD": 1, + "CNA": 2, + "SELF": 3, + } +) + +func (x Severity_Source) Enum() *Severity_Source { + p := new(Severity_Source) + *p = x + return p +} + +func (x Severity_Source) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Severity_Source) Descriptor() protoreflect.EnumDescriptor { + return file_vulnerability_proto_enumTypes[3].Descriptor() +} + +func (Severity_Source) Type() protoreflect.EnumType { + return &file_vulnerability_proto_enumTypes[3] +} + +func (x Severity_Source) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Severity_Source.Descriptor instead. +func (Severity_Source) EnumDescriptor() ([]byte, []int) { + return file_vulnerability_proto_rawDescGZIP(), []int{5, 1} +} + type Credit_Type int32 const ( @@ -250,11 +303,11 @@ func (x Credit_Type) String() string { } func (Credit_Type) Descriptor() protoreflect.EnumDescriptor { - return file_vulnerability_proto_enumTypes[3].Descriptor() + return file_vulnerability_proto_enumTypes[4].Descriptor() } func (Credit_Type) Type() protoreflect.EnumType { - return &file_vulnerability_proto_enumTypes[3] + return &file_vulnerability_proto_enumTypes[4] } func (x Credit_Type) Number() protoreflect.EnumNumber { @@ -327,11 +380,11 @@ func (x Reference_Type) String() string { } func (Reference_Type) Descriptor() protoreflect.EnumDescriptor { - return file_vulnerability_proto_enumTypes[4].Descriptor() + return file_vulnerability_proto_enumTypes[5].Descriptor() } func (Reference_Type) Type() protoreflect.EnumType { - return &file_vulnerability_proto_enumTypes[4] + return &file_vulnerability_proto_enumTypes[5] } func (x Reference_Type) Number() protoreflect.EnumNumber { @@ -738,7 +791,9 @@ type Severity struct { // The type of this severity entry. Type Severity_Type `protobuf:"varint,1,opt,name=type,proto3,enum=osv.Severity_Type" json:"type,omitempty"` // The quantitative score. - Score string `protobuf:"bytes,2,opt,name=score,proto3" json:"score,omitempty"` + Score string `protobuf:"bytes,2,opt,name=score,proto3" json:"score,omitempty"` + // Optional. The source of this severity assessment. + Source Severity_Source `protobuf:"varint,3,opt,name=source,proto3,enum=osv.Severity_Source" json:"source,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -787,6 +842,13 @@ func (x *Severity) GetScore() string { return "" } +func (x *Severity) GetSource() Severity_Source { + if x != nil { + return x.Source + } + return Severity_SOURCE_UNSPECIFIED +} + type Credit struct { state protoimpl.MessageState `protogen:"open.v1"` // The name to give credit to. @@ -1129,17 +1191,23 @@ const file_vulnerability_proto_rawDesc = "" + "\bversions\x18\x03 \x03(\tR\bversions\x12G\n" + "\x12ecosystem_specific\x18\x04 \x01(\v2\x17.google.protobuf.StructR\x12ecosystem_specific\x12E\n" + "\x11database_specific\x18\x05 \x01(\v2\x17.google.protobuf.StructR\x11database_specific\x12)\n" + - "\bseverity\x18\x06 \x03(\v2\r.osv.SeverityR\bseverity\"\x94\x01\n" + + "\bseverity\x18\x06 \x03(\v2\r.osv.SeverityR\bseverity\"\x80\x02\n" + "\bSeverity\x12&\n" + "\x04type\x18\x01 \x01(\x0e2\x12.osv.Severity.TypeR\x04type\x12\x14\n" + - "\x05score\x18\x02 \x01(\tR\x05score\"J\n" + + "\x05score\x18\x02 \x01(\tR\x05score\x12,\n" + + "\x06source\x18\x03 \x01(\x0e2\x14.osv.Severity.SourceR\x06source\"J\n" + "\x04Type\x12\x0f\n" + "\vUNSPECIFIED\x10\x00\x12\v\n" + "\aCVSS_V3\x10\x01\x12\v\n" + "\aCVSS_V2\x10\x02\x12\v\n" + "\aCVSS_V4\x10\x03\x12\n" + "\n" + - "\x06Ubuntu\x10\x04\"\x9f\x02\n" + + "\x06Ubuntu\x10\x04\"<\n" + + "\x06Source\x12\x16\n" + + "\x12SOURCE_UNSPECIFIED\x10\x00\x12\a\n" + + "\x03NVD\x10\x01\x12\a\n" + + "\x03CNA\x10\x02\x12\b\n" + + "\x04SELF\x10\x03\"\x9f\x02\n" + "\x06Credit\x12\x12\n" + "\x04name\x18\x01 \x01(\tR\x04name\x12\x18\n" + "\acontact\x18\x02 \x03(\tR\acontact\x12$\n" + @@ -1210,52 +1278,54 @@ func file_vulnerability_proto_rawDescGZIP() []byte { return file_vulnerability_proto_rawDescData } -var file_vulnerability_proto_enumTypes = make([]protoimpl.EnumInfo, 5) +var file_vulnerability_proto_enumTypes = make([]protoimpl.EnumInfo, 6) var file_vulnerability_proto_msgTypes = make([]protoimpl.MessageInfo, 9) var file_vulnerability_proto_goTypes = []any{ (Commit_RepoType)(0), // 0: osv.Commit.RepoType (Range_Type)(0), // 1: osv.Range.Type (Severity_Type)(0), // 2: osv.Severity.Type - (Credit_Type)(0), // 3: osv.Credit.Type - (Reference_Type)(0), // 4: osv.Reference.Type - (*Commit)(nil), // 5: osv.Commit - (*Package)(nil), // 6: osv.Package - (*Event)(nil), // 7: osv.Event - (*Range)(nil), // 8: osv.Range - (*Affected)(nil), // 9: osv.Affected - (*Severity)(nil), // 10: osv.Severity - (*Credit)(nil), // 11: osv.Credit - (*Reference)(nil), // 12: osv.Reference - (*Vulnerability)(nil), // 13: osv.Vulnerability - (*structpb.Struct)(nil), // 14: google.protobuf.Struct - (*timestamppb.Timestamp)(nil), // 15: google.protobuf.Timestamp + (Severity_Source)(0), // 3: osv.Severity.Source + (Credit_Type)(0), // 4: osv.Credit.Type + (Reference_Type)(0), // 5: osv.Reference.Type + (*Commit)(nil), // 6: osv.Commit + (*Package)(nil), // 7: osv.Package + (*Event)(nil), // 8: osv.Event + (*Range)(nil), // 9: osv.Range + (*Affected)(nil), // 10: osv.Affected + (*Severity)(nil), // 11: osv.Severity + (*Credit)(nil), // 12: osv.Credit + (*Reference)(nil), // 13: osv.Reference + (*Vulnerability)(nil), // 14: osv.Vulnerability + (*structpb.Struct)(nil), // 15: google.protobuf.Struct + (*timestamppb.Timestamp)(nil), // 16: google.protobuf.Timestamp } var file_vulnerability_proto_depIdxs = []int32{ 0, // 0: osv.Commit.repo_type:type_name -> osv.Commit.RepoType 1, // 1: osv.Range.type:type_name -> osv.Range.Type - 7, // 2: osv.Range.events:type_name -> osv.Event - 14, // 3: osv.Range.database_specific:type_name -> google.protobuf.Struct - 6, // 4: osv.Affected.package:type_name -> osv.Package - 8, // 5: osv.Affected.ranges:type_name -> osv.Range - 14, // 6: osv.Affected.ecosystem_specific:type_name -> google.protobuf.Struct - 14, // 7: osv.Affected.database_specific:type_name -> google.protobuf.Struct - 10, // 8: osv.Affected.severity:type_name -> osv.Severity + 8, // 2: osv.Range.events:type_name -> osv.Event + 15, // 3: osv.Range.database_specific:type_name -> google.protobuf.Struct + 7, // 4: osv.Affected.package:type_name -> osv.Package + 9, // 5: osv.Affected.ranges:type_name -> osv.Range + 15, // 6: osv.Affected.ecosystem_specific:type_name -> google.protobuf.Struct + 15, // 7: osv.Affected.database_specific:type_name -> google.protobuf.Struct + 11, // 8: osv.Affected.severity:type_name -> osv.Severity 2, // 9: osv.Severity.type:type_name -> osv.Severity.Type - 3, // 10: osv.Credit.type:type_name -> osv.Credit.Type - 4, // 11: osv.Reference.type:type_name -> osv.Reference.Type - 15, // 12: osv.Vulnerability.published:type_name -> google.protobuf.Timestamp - 15, // 13: osv.Vulnerability.modified:type_name -> google.protobuf.Timestamp - 15, // 14: osv.Vulnerability.withdrawn:type_name -> google.protobuf.Timestamp - 9, // 15: osv.Vulnerability.affected:type_name -> osv.Affected - 12, // 16: osv.Vulnerability.references:type_name -> osv.Reference - 14, // 17: osv.Vulnerability.database_specific:type_name -> google.protobuf.Struct - 10, // 18: osv.Vulnerability.severity:type_name -> osv.Severity - 11, // 19: osv.Vulnerability.credits:type_name -> osv.Credit - 20, // [20:20] is the sub-list for method output_type - 20, // [20:20] is the sub-list for method input_type - 20, // [20:20] is the sub-list for extension type_name - 20, // [20:20] is the sub-list for extension extendee - 0, // [0:20] is the sub-list for field type_name + 3, // 10: osv.Severity.source:type_name -> osv.Severity.Source + 4, // 11: osv.Credit.type:type_name -> osv.Credit.Type + 5, // 12: osv.Reference.type:type_name -> osv.Reference.Type + 16, // 13: osv.Vulnerability.published:type_name -> google.protobuf.Timestamp + 16, // 14: osv.Vulnerability.modified:type_name -> google.protobuf.Timestamp + 16, // 15: osv.Vulnerability.withdrawn:type_name -> google.protobuf.Timestamp + 10, // 16: osv.Vulnerability.affected:type_name -> osv.Affected + 13, // 17: osv.Vulnerability.references:type_name -> osv.Reference + 15, // 18: osv.Vulnerability.database_specific:type_name -> google.protobuf.Struct + 11, // 19: osv.Vulnerability.severity:type_name -> osv.Severity + 12, // 20: osv.Vulnerability.credits:type_name -> osv.Credit + 21, // [21:21] is the sub-list for method output_type + 21, // [21:21] is the sub-list for method input_type + 21, // [21:21] is the sub-list for extension type_name + 21, // [21:21] is the sub-list for extension extendee + 0, // [0:21] is the sub-list for field type_name } func init() { file_vulnerability_proto_init() } @@ -1268,7 +1338,7 @@ func file_vulnerability_proto_init() { File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_vulnerability_proto_rawDesc), len(file_vulnerability_proto_rawDesc)), - NumEnums: 5, + NumEnums: 6, NumMessages: 9, NumExtensions: 0, NumServices: 0, diff --git a/docs/schema.md b/docs/schema.md index 0e8bd88a..22ba4a50 100644 --- a/docs/schema.md +++ b/docs/schema.md @@ -57,7 +57,8 @@ A JSON Schema for validation is also available "details": string, "severity": [ { "type": string, - "score": string + "score": string, + "source": string } ], "affected": [ { "package": { @@ -67,7 +68,8 @@ A JSON Schema for validation is also available }, "severity": [ { "type": string, - "score": string + "score": string, + "source": string } ], "ranges": [ { "type": string, @@ -143,8 +145,8 @@ string of the format `-`, where `DB` names the database and `ENTRYID` is in the format used by the database. For example: "OSV-2020-111", "CVE-2021-3114", or "GHSA-vp9c-fpxx-744v". -The `x_` prefix can be used to denote a local database that isn't aggregated -by OSV.dev, allowing external records to be schema-compliant. For example: +The `x_` prefix can be used to denote a local database that isn't aggregated +by OSV.dev, allowing external records to be schema-compliant. For example: "x_CUSTOM-0001". The defined database prefixes and their "home" databases are: @@ -789,7 +791,8 @@ display sites to unnecessary vulnerabilities.) { "severity": [ { "type": string, - "score": string + "score": string, + "source": string } ] } ``` @@ -797,7 +800,7 @@ display sites to unnecessary vulnerabilities.) The `severity` field is a JSON array that allows generating systems to describe the severity of a vulnerability using one or more quantitative scoring methods. Each `severity` item is a JSON object specifying a `type` and `score` property, -described below. +as well as an optional `source` property, described below. ### severity[].type field @@ -817,6 +820,20 @@ describes the quantitative method used to calculate the associated `score`. The `severity[].score` property is a string representing the severity score based on the selected `severity[].type`, as described above. +### severity[].source field + +The `severity[].source` property is an optional string indicating the origin of the +severity assessment. + +If `source` is omitted, the rating is implicitly attributed to the home database +(as identified by the record's `id` field), whether as author or endorser. + +| Source | Description | +| --------- | ----------- | +| `NVD` | The severity was provided by the [National Vulnerability Database (NVD)](https://nvd.nist.gov/). | +| `CNA` | The severity was provided by the [CVE Numbering Authority (CNA)](https://www.cve.org/ProgramOrganization/CNAs) that assigned the CVE. | +| `SELF` | The severity was provided by the home database. Unlike omitting `source`, this is an explicit declaration of provenance. | + ## affected fields ```json @@ -829,7 +846,8 @@ on the selected `severity[].type`, as described above. }, "severity": [ { "type": string, - "score": string + "score": string, + "source": string } ], "ranges": [ { "type": string, @@ -1070,7 +1088,7 @@ Only **a single type** (either `introduced`, `fixed`, `last_affected`, `limit`) is allowed in each event object. For instance, `{"introduced": "1.0.0", "fixed": "1.0.2"}` is **invalid**. -Entries in the `events` array may be "last_affected" or "fixed" events, +Entries in the `events` array may be "last_affected" or "fixed" events, but not both. It's **strongly recommended** to use `fixed` instead of `last_affected` where possible, as it precisely identifies the version which contains the fix. `last_affected` should be thought of as the hard ceiling diff --git a/proto/vulnerability.proto b/proto/vulnerability.proto index c26bf84b..9ed3e4ad 100644 --- a/proto/vulnerability.proto +++ b/proto/vulnerability.proto @@ -127,10 +127,19 @@ message Severity { CVSS_V4 = 3; Ubuntu = 4; } + // Source of the severity. + enum Source { + SOURCE_UNSPECIFIED = 0; + NVD = 1; + CNA = 2; + SELF = 3; + } // The type of this severity entry. Type type = 1; // The quantitative score. string score = 2; + // Optional. The source of this severity assessment. + Source source = 3; } message Credit { diff --git a/tools/osv-linter/internal/checks/schema_generated.json b/tools/osv-linter/internal/checks/schema_generated.json index cf123dd7..c854d360 100644 --- a/tools/osv-linter/internal/checks/schema_generated.json +++ b/tools/osv-linter/internal/checks/schema_generated.json @@ -482,6 +482,14 @@ }, "score": { "type": "string" + }, + "source": { + "type": "string", + "enum": [ + "NVD", + "CNA", + "SELF" + ] } }, "allOf": [ diff --git a/validation/schema.json b/validation/schema.json index cf123dd7..c854d360 100644 --- a/validation/schema.json +++ b/validation/schema.json @@ -482,6 +482,14 @@ }, "score": { "type": "string" + }, + "source": { + "type": "string", + "enum": [ + "NVD", + "CNA", + "SELF" + ] } }, "allOf": [