fix(hdf-converters): map Twistlock's distro-vendor pass-through severities - #8618
Open
wdower wants to merge 1 commit into
Open
fix(hdf-converters): map Twistlock's distro-vendor pass-through severities#8618wdower wants to merge 1 commit into
wdower wants to merge 1 commit into
Conversation
…ities
For OS-vendor-maintained packages Prisma Cloud reports the vendor's own
severity string instead of NVD's, so distro vocabulary reaches the scan
report. Per the vendor table in Prisma's CVSS-scoring doc and the
vendors' published definitions:
unassigned / not yet assigned / untriaged (Ubuntu) -> 0.5 (explicit
no-rating takes the conservative medium, matching dependency-track's
'unassigned' and the grype mapper's 'unknown')
unimportant (Debian/SUSE) -> 0.1 (Debian: the problem does not affect
the shipped binary package; Prisma ranks it below negligible)
negligible (Ubuntu) -> 0.1 ('technically a security problem' but
theoretical/no real damage — the lowest rating)
The minimal ratings sit at 0.1 rather than 0.0: this codebase reserves
the 0.0 tier for informational non-findings, and impact 0 exports as
Not_Applicable in checklists — hiding findings the scanner reported.
Adds a fixture carrying all five severities plus a mapped control case,
with targeted impact assertions.
With #8610's warn-and-default fix this closes the Twistlock half of the
severity data-loss report in #8611.
Signed-off-by: Will <will@dower.dev>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For OS-vendor-maintained packages Twistlock/Prisma Cloud reports the vendor's own severity string instead of NVD's, so distro vocabulary reaches the scan report. Closest doc available describing the possible severity levels one can see in the source format is the vendor table in Prisma's CVSS-scoring doc.
So for severity level mappings into OHDF, we're going to go with:
Adds a (synthetic) fixture carrying all five severities plus a mapped control case, with targeted impact assertions. I am following up with the folks who brought #8611 to our attention to see if we can get a copy of the Twistlock scan that triggered the original error so that we can confirm it works with that one.
With #8610's warn-and-default fix this closes the Twistlock half of the severity data-loss report in #8611.