Comments (9)
gscottwilson
commented on June 21, 2024
1
Had a chance to dive deeper on this and discovered it is indeed a regression due to my refactor. Apologies for the confusion introduced.
The 5.9 was a red herring and 6.1 was correct.
I’ve resolved the issue and sending a PR for your review.
from cvss-v4-calculator.
pandatix
commented on June 21, 2024
This looks like a regression, my Go implem computes 6.1 too :/
I'll try to find where the source and post updates soon.
EDIT: had an emergency to handle...
from cvss-v4-calculator.
skontar
commented on June 21, 2024
Could be regression in #52 .
from cvss-v4-calculator.
skontar
commented on June 21, 2024
Yep, it is there.
from cvss-v4-calculator.
skontar
commented on June 21, 2024
@gscottwilson , can you please have look?
from cvss-v4-calculator.
skontar
commented on June 21, 2024
Commit 266c4f6 gives 6.1.
from cvss-v4-calculator.
gscottwilson
commented on June 21, 2024
Looks like the unrounded score in this case is 5.941666666666666 so the redhat calculator is correctly rounding to 5.9 and the FIRST calculator as deployed is incorrect at 6.1
from cvss-v4-calculator.
skontar
commented on June 21, 2024
Unfortunately, rounding was not figured out yet by the SIG, so it is hard to tell which is right and which is wrong. However, I am unsure how 5.941666666666666 could incorrectly be rounded to 6.1, I would expect 6.0?
Anyway, I have a colleague who may have some time to tackle rounding issues for good somewhat soon™.
from cvss-v4-calculator.
gscottwilson
commented on June 21, 2024
Sounds good. Thanks for the heads up
from cvss-v4-calculator.
Related Issues (20)
- CVSS v4.0 should show only one score and call sections "metrics"
- EQ3 needs to be changed to [0-2]
- Show macro vector in a more transparent way
- Specific Vector Crashes Calculator HOT 1
- New base scores with "MaxBase" considerations.
- Provider Urgency (U): White → Clear
- Bug/compliance: metrics could be defined more than once
- Bug/compliance: metrics with invalid value gives NaN score
- Question: How do CVSS v4.0 Nomenclatures map to CVSS 3.x score types? HOT 12
- Macrovector=1 does not always mean "Medium" HOT 3
- CVSS vector should be generated in Base/Threat/Environmental/Supplemental order HOT 3
- Bug/compliance: (Non-)mandatory metrics behavior is not implemented
- Incorrect metric order HOT 4
- Invalid vector validation
- Potential Incorrect Rounding For Final Score HOT 7
- Cannot run the code locally. HOT 4
- Refactor to reduce dependency on Vue HOT 5
- API endpoint HOT 3
- Unknown variable eq3 / eq6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cvss-v4-calculator.