Skip to content

fix: Correct CVSSv4 parsing for low precision OSSIndex values#7935

Merged
jeremylong merged 2 commits intodependency-check:mainfrom
chadlwilson:fix-cvssv4-parsing
Sep 21, 2025
Merged

fix: Correct CVSSv4 parsing for low precision OSSIndex values#7935
jeremylong merged 2 commits intodependency-check:mainfrom
chadlwilson:fix-cvssv4-parsing

Conversation

@chadlwilson
Copy link
Copy Markdown
Collaborator

@chadlwilson chadlwilson commented Sep 21, 2025

Description of Change

  • corrects parsing of low precision CVSS v4 values, especially from OSSIndex
  • adds tests, including for CVSSv2 and v3 parsing which are not subject to the same issue due to the way their comparisons are done

Related issues

Have test cases been added to cover the new functionality?

yes

@boring-cyborg boring-cyborg bot added core changes to core tests test cases labels Sep 21, 2025
Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
Copy link
Copy Markdown
Collaborator

@marcelstoer marcelstoer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Copy Markdown
Collaborator

@jeremylong jeremylong left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jeremylong jeremylong merged commit 36543b5 into dependency-check:main Sep 21, 2025
6 checks passed
@chadlwilson chadlwilson deleted the fix-cvssv4-parsing branch September 21, 2025 10:11
@jeremylong jeremylong added this to the 12.1.6 milestone Sep 22, 2025
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Oct 23, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

core changes to core tests test cases

Projects

None yet

Development

Successfully merging this pull request may close these issues.

12.1.5 has invalid CVSS base score with CVSSv4 from OSS Index

3 participants