-
Notifications
You must be signed in to change notification settings - Fork 42
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #871 from tschmidtb51/ssvc
SSVC
- Loading branch information
Showing
59 changed files
with
3,492 additions
and
21 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| ### Invalid SSVC | ||
|
|
||
| It MUST be tested that the given SSVC object is valid according to the referenced schema. | ||
|
|
||
| The relevant path for this test is: | ||
|
|
||
| ``` | ||
| /vulnerabilities[]/metrics[]/content/ssvc_v1 | ||
| ``` | ||
|
|
||
| *Example 1 (which fails the test):* | ||
|
|
||
| ``` | ||
| "ssvc_v1": { | ||
| "id": "CVE-1900-0001", | ||
| "schemaVersion": "1-0-1", | ||
| "timestamp": "2024-01-24T10:00:00.000Z" | ||
| } | ||
| ``` | ||
|
|
||
| > The required element `selections` is missing. | ||
| > A tool MAY add the missing property `id` based on the values given in `cve` respectively `ids[]/text` as quick fix. |
44 changes: 44 additions & 0 deletions
44
csaf_2.1/prose/edit/src/tests-01-mndtr-47-inconsistent-ssvc-id.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| ### Inconsistent SSVC ID | ||
|
|
||
| For each `ssvc_v1` object it MUST be tested that `id` is either the CVE of the vulnerability given in `cve` or the `text` of an item in the `ids` array. | ||
| The test MUST fail, if the `id` equals the `/document/tracking/id` and the CSAF document contains more than one vulnerability. | ||
|
|
||
| The relevant path for this test is: | ||
|
|
||
| ``` | ||
| /vulnerabilities[]/metrics[]/content/ssvc_v1/id | ||
| ``` | ||
|
|
||
| *Example 1 (which fails the test):* | ||
|
|
||
| ``` | ||
| "vulnerabilities": [ | ||
| { | ||
| "cve": "CVE-1900-0001", | ||
| "metrics": [ | ||
| { | ||
| "content": { | ||
| "ssvc_v1": { | ||
| "id": "CVE-1900-0002", | ||
| "schemaVersion": "1-0-1", | ||
| "selections": [ | ||
| { | ||
| "name": "Exploitation", | ||
| "namespace": "ssvc", | ||
| "values": [ | ||
| "None" | ||
| ], | ||
| "version": "1.1.0" | ||
| } | ||
| ], | ||
| "timestamp": "2024-01-24T10:00:00.000Z" | ||
| } | ||
| }, | ||
| // ... | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| > The SSVC ID does not match the CVE ID. |
57 changes: 57 additions & 0 deletions
57
csaf_2.1/prose/edit/src/tests-01-mndtr-48-ssvc-decision-points.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| ### SSVC Decision Points | ||
|
|
||
| For each SSVC decision point given under `selections` with a registered `namespace`, it MUST be tested that given decision point exists, is valid and the items in `values` are ordered correctly. | ||
|
|
||
| > According to the SSVC project, the following values are currently registered: | ||
| > | ||
| > ``` | ||
| > cvss | ||
| > nciss | ||
| > ssvc | ||
| > ``` | ||
| > | ||
| > A list of all valid decision points including their values is available at the [SSVC repository](https://github.com/CERTCC/SSVC/tree/main/data/json/decision_points). | ||
| > The items in `values` need to have the same order as in their definition. | ||
| The relevant path for this test is: | ||
| ``` | ||
| /vulnerabilities[]/metrics[]/content/ssvc_v1/selections[] | ||
| ``` | ||
| *Example 1 (which fails the test):* | ||
| ``` | ||
| "vulnerabilities": [ | ||
| { | ||
| "cve": "CVE-1900-0001", | ||
| "metrics": [ | ||
| { | ||
| "content": { | ||
| "ssvc_v1": { | ||
| "id": "CVE-1900-0001", | ||
| "schemaVersion": "1-0-1", | ||
| "selections": [ | ||
| { | ||
| "name": "Mission Impact", | ||
| "namespace": "ssvc", | ||
| "values": [ | ||
| "None", | ||
| "Degraded" | ||
| ], | ||
| "version": "1.0.0" | ||
| } | ||
| ], | ||
| "timestamp": "2024-01-24T10:00:00.000Z" | ||
| } | ||
| }, | ||
| // ... | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| ``` | ||
| > The SSVC decision point `Mission Impact` doesn't have the value `Degraded` in version `1.0.0`. | ||
| > If applicable, a tool MAY sort the items in `values` according to the order of their definition as a quick fix. |
66 changes: 66 additions & 0 deletions
66
csaf_2.1/prose/edit/src/tests-01-mndtr-49-inconsistent-ssvc-timestamp.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| ### Inconsistent SSVC Timestamp | ||
|
|
||
| For each vulnerability, it MUST be tested that the SSVC `timestamp` is earlier or equal to the `date` of the newest item of the `revision_history` | ||
| if the document status is `final` or `interim`. | ||
| As the timestamps might use different timezones, the sorting MUST take timezones into account. | ||
|
|
||
| The relevant path for this test is: | ||
|
|
||
| ``` | ||
| /vulnerabilities[]/metrics[]/content/ssvc_v1/timestamp | ||
| ``` | ||
|
|
||
| *Example 1 (which fails the test):* | ||
|
|
||
| ``` | ||
| "document": { | ||
| // ... | ||
| "distribution": { | ||
| "tlp": { | ||
| "label": "CLEAR" | ||
| } | ||
| }, | ||
| // ... | ||
| "tracking": { | ||
| // ... | ||
| "revision_history": [ | ||
| { | ||
| "date": "2024-01-24T10:00:00.000Z", | ||
| "number": "1", | ||
| "summary": "Initial version." | ||
| } | ||
| ], | ||
| "status": "final", | ||
| // ... | ||
| } | ||
| }, | ||
| "vulnerabilities": [ | ||
| { | ||
| "cve": "CVE-1900-0001", | ||
| "metrics": [ | ||
| { | ||
| "content": { | ||
| "ssvc_v1": { | ||
| "id": "CVE-1900-0001", | ||
| "schemaVersion": "1-0-1", | ||
| "selections": [ | ||
| { | ||
| "name": "Exploitation", | ||
| "namespace": "ssvc", | ||
| "values": [ | ||
| "Active" | ||
| ], | ||
| "version": "1.1.0" | ||
| } | ||
| ], | ||
| "timestamp": "2024-07-13T10:00:00.000Z" | ||
| } | ||
| }, | ||
| // ... | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| > The document is in status `final` but the SSVC `timestamp` is newer than the `date` of newest item in the `revision_history`. |
Oops, something went wrong.