
    Cj\5                         S r SSKJr  SSKJr  SSKJr  SSKJrJ	r	J
r
JrJrJrJrJr  SSKJrJrJrJr  S r " S	 S
\5      rg)z
Implements class for CVSS2 specification as defined at
https://www.first.org/cvss/v2/guide .

The library is compatible with both Python 2 and Python 3.
    )unicode_literals)ROUND_HALF_UP)Decimal   )ENVIRONMENTAL_METRICSMETRICS_ABBREVIATIONSMETRICS_ABBREVIATIONS_JSONMETRICS_MANDATORYMETRICS_VALUE_NAMESMETRICS_VALUESTEMPORAL_METRICSOrderedDict)CVSS2MalformedErrorCVSS2MandatoryErrorCVSS2RHMalformedErrorCVSS2RHScoreDoesNotMatchc                 <    U R                  [        S5      [        S9$ )z
Round to one decimal.
z0.1)rounding)quantizeDr   )values    \/home/rurouni/.local/share/pipx/venvs/strix-agent/lib/python3.13/site-packages/cvss/cvss2.pyround_to_1_decimalr   #   s     >>!E(]>;;    c                       \ rS rSrSr\S 5       rS rS rS r	S r
S rS	 rS
 rSS jrS rSS jrS rS rS rS rS rS rS rS rSS jrS rS rSrg)CVSS2*   z<
Class to hold CVSS2 vector, parsed values, and all scores.
c                 ~    UR                  SS5      u  p# [	        U5      nU " U5      nUR                  5       S   U:X  a  U$ [        SR                  X5R                  5       S   U5      5      e! [         a    [        SR                  U5      5      ef = f! [         a    [        SR                  U5      5      ef = f)a  
Creates a CVSS2 object from CVSS vector in Red Hat notation, e.g. containing base score.
Also checks if the score matches the vector.

Args:
    vector (str): string specifying CVSS3 vector in Red Hat notation, fields may be out of
                  order, fields which are not mandatory may be missing

Returns:
    CVSS2: the generated CVSS2 object created from the vector string

Raises:
    CVSS2RHMalformedError: if vector is not in expected format for Red Hat notation
    CVSS2RHScoreDoesNotMatch: if vector and score do not match
/r   z0Malformed CVSS2 vector in Red Hat notation "{0}"r   zgCVSS2 vector in Red Hat notation "{0}" has score of "{1}" which does not match specified score of "{2}")split
ValueErrorr   formatfloatscoresr   )clsvectorscorebase_vectorscore_valuecvss_objects         r   from_rh_vectorCVSS2.from_rh_vector/   s    "	!'c1!5E
	,K
 +&"k1*FFLf!3!3!5a!8%G   	'BII&Q 	  	'BII&Q 	s   A/ B /%B%B<c                     Xl         0 U l        SU l        SU l        SU l        U R                  5         U R                  5         U R                  5         U R                  5         U R                  5         g)z
Args:
    vector (str): string specifying CVSS2 vector, fields may be out of order, fields which
                  are not mandatory may be missing
N)
r&   metrics
base_scoretemporal_scoreenvironmental_scoreparse_vectorcheck_mandatorycompute_base_scorecompute_temporal_scorecompute_environmental_score)selfr&   s     r   __init__CVSS2.__init__W   sc     "#' !##%((*r   c                    U R                   S:X  a  [        S5      eU R                   R                  S5      (       a  [        S5      eU R                   R                  S5      nU H  nUS:X  a$  [        SR	                  U R                   5      5      e UR                  S5      u  p4U[        ;   a`  U[        U   ;   a9  X0R                  ;   a  [        SR	                  U5      5      eX@R                  U'   M  [        S	R	                  XB5      5      e[        S
R	                  X25      5      e   g! [
         a    [        SR	                  U5      5      ef = f)zm
Parses metrics from the CVSS2 vector.

Raises:
    CVSS2MalformedError: if vector is not in expected format
 z'Malformed CVSS2 vector, vector is emptyr   z$Malformed CVSS2 vector, trailing "/"z!Empty field in CVSS2 vector "{0}":zMalformed CVSS2 field "{0}"zDuplicate metric "{0}"z"Unknown value "{0}" in field "{1}"z#Unknown metric "{0}" in field "{1}"N)	r&   r   endswithr    r"   r!   r   r   r.   )r7   fieldsfieldmetricr   s        r   r2   CVSS2.parse_vectorj   s@    ;;"%&OPP;;$$%&LMM""3' E{)*M*T*TUYU`U`*abbW %C 0 ..N622-12J2Q2QRX2YZZ+0LL(-<CCEQ  *9@@O '   W)*G*N*Nu*UVVWs   D,,%Ec                     / n[          H%  nX R                  ;  d  M  UR                  U5        M'     U(       a)  [        SR	                  SR                  U5      5      5      eg)z
Checks if mandatory fields are in CVSS2 vector.

Raises:
    CVSS2MandatoryError: if mandatory metric is missing in the vector
zMissing mandatory metrics "{0}"z, N)r
   r.   appendr   r"   join)r7   missingmandatory_metrics      r   r3   CVSS2.check_mandatory   sV      1||3/0 !2 %&G&N&NtyyY`Oa&bcc r   c                 V    U R                   R                  US5      n[        U   U   nU$ )z>
Gets value of specific metric specified by its abbreviation.
ND)r.   getr   r7   abbreviationstring_valueresults       r   	get_valueCVSS2.get_value   s.     ||''d;-l;r   c                 V    U R                   R                  US5      n[        U   U   nU$ )zL
Gets textual description of specific metric specified by its abbreviation.
rI   )r.   rJ   r   rK   s       r   get_value_descriptionCVSS2.get_value_description   s.     ||''d;$\2<@r   c                     [        S5      [        S5      [        S5      U R                  S5      -
  [        S5      U R                  S5      -
  -  [        S5      U R                  S5      -
  -  -
  -  $ )zC
Impact = 10.41*(1-(1-ConfImpact)*(1-IntegImpact)*(1-AvailImpact))
10.411CIA)r   rO   r7   s    r   impact_equationCVSS2.impact_equation   sj     zcFvs++vs++-vs++--
 	
r   c                 v   [        [        S5      [        S5      [        S5      [        S5      U R                  S5      U R                  S5      -  -
  [        S5      U R                  S5      U R                  S5      -  -
  -  [        S5      U R                  S5      U R                  S	5      -  -
  -  -
  -  5      $ )
z
AdjustedImpact = min(10,10.41*(1-(1-ConfImpact*ConfReq)*(1-IntegImpact*IntegReq)
                             *(1-AvailImpact*AvailReq)))
10rU   rV   rW   CRrX   IRrY   AR)minr   rO   rZ   s    r   adjusted_impact_equationCVSS2.adjusted_impact_equation   s    
 dGgJ#S6DNN3/$..2FFFS6DNN3/$..2FFFHS6DNN3/$..2FFFHH	
 		
r   c                    U(       a  U R                  5       nOU R                  5       n[        S5      U R                  S5      -  U R                  S5      -  U R                  S5      -  nU[        S5      :X  a  [        S5      O
[        S5      n[	        [        S5      U-  [        S5      U-  -   [        S	5      -
  U-  5      $ )
z
BaseScore = round_to_1_decimal(((0.6*Impact)+(0.4*Exploitability)-1.5)*f(Impact))
Impact = see impact_equation or modified_impact_equation
Exploitability = 20*AccessVector*AccessComplexity*Authentication
f(impact)= 0 if Impact=0, 1.176 otherwise
20AVACAu0z1.176z0.6z0.4z1.5)rc   r[   r   rO   r   )r7   adjusted_impactimpactexploitabilityf_impacts        r   base_score_equationCVSS2.base_score_equation   s     224F))+F dGdnnT**T^^D-AADNNSWDXX 	 $qv-1S61W:!hAeH~$=>5IXU
 	
r   c                 T    [        [        S5      U R                  5       5      U l        g)zP
Compute base score using normal Impact equation. Do not allow negative result.
0.0N)maxr   ro   r/   rZ   s    r   r4   CVSS2.compute_base_score   s     ah(@(@(BCr   c                     U(       a  U R                  SS9nOU R                  n[        X R                  S5      -  U R                  S5      -  U R                  S5      -  5      $ )zq
TemporalScore = round_to_1_decimal(BaseScore*Exploitability
                *RemediationLevel*ReportConfidence)
Trk   ERLRC)ro   r/   r   rO   )r7   rk   r/   s      r   temporal_score_equationCVSS2.temporal_score_equation   s\    
 11$1GJJ!,,t~~d/CCdnnUYFZZ
 	
r   c                    ^  [        U 4S j[         5       5      (       a  ST l        g[        [	        S5      T R                  5       5      T l        g)z6
Compute temporal score using normal Impact equation.
c              3   b   >#    U  H$  nTR                   R                  US 5      S :H  v   M&     g7frI   Nr.   rJ   .0ar7   s     r   	<genexpr>/CVSS2.compute_temporal_score.<locals>.<genexpr>   s)     K:JQt||4(D0:J   ,/Nrr   )allr   r0   rs   r   rz   rZ   s   `r   r5   CVSS2.compute_temporal_score   s;     K:JKKK"&D"%ah0L0L0N"ODr   c                    ^  [        U 4S j[         5       5      (       a  ST l        gT R                  SS9n[	        U[        S5      U-
  T R                  S5      -  -   T R                  S5      -  5      n[        [        S5      U5      T l        g)	a  
EnvironmentalScore = round_to_1_decimal((AdjustedTemporal+
(10-AdjustedTemporal)*CollateralDamagePotential)*TargetDistribution)

AdjustedTemporal = TemporalScore recomputed with the BaseScores Impact sub-equation
                   replaced with the AdjustedImpact equation
c              3   b   >#    U  H$  nTR                   R                  US 5      S :H  v   M&     g7fr~   r   r   s     r   r   4CVSS2.compute_environmental_score.<locals>.<genexpr>  s)     P:OQt||4(D0:Or   NTrv   r^   CDPTDrr   )r   r   r1   rz   r   r   rO   rs   )r7   temporal_score_adjustedraw_environmental_scores   `  r   r6   !CVSS2.compute_environmental_score   s     P:OPPP'+D$&*&B&BSW&B&X#&8+w!88DNN5<QQR ..&	''# (+1U85L'MD$r   c                 l    U R                   U R                  U R                  4n[        S U 5       5      $ )z
Returns all computed scores.

Returns:
    (tuple): Base Score, Temporal Score, Environmental Score, either float or None if not
             defined
c              3   @   #    U  H  ob  [        U5      OS v   M     g 7fN)r#   )r   r   s     r   r   CVSS2.scores.<locals>.<genexpr>  s     I&QU1XD8&s   )r/   r0   r1   tuple)r7   r$   s     r   r$   CVSS2.scores  s1     //4#6#68P8PQI&IIIr   c                     / n[          HK  nX R                  ;   d  M  U R                  U   nUS:w  d  M+  UR                  SR                  X#5      5        MM     SR	                  U5      $ )z
Returns vector without optional metrics marked as ND and in preferred order.

Returns:
    (str): cleaned CVSS2 with metrics in correct order
rI   z{0}:{1}r   )r   r.   rC   r"   rD   )r7   r&   r@   r   s       r   clean_vectorCVSS2.clean_vector  sZ     +F%V,D=MM)"2"26"AB	 ,
 xxr   c                 F   / nU R                   U R                  U R                  4 Hn  nUc  UR                  S5        M  U[	        S5      ::  a  UR                  S5        M;  U[	        S5      ::  a  UR                  S5        M]  UR                  S5        Mp     [        U5      $ )z
Returns severities based on scores. https://nvd.nist.gov/vuln-metrics/cvss

Returns:
    (tuple): Base Severity, Temporal Severity, Environmental Severity as strings
Nonez3.9Lowz6.9MediumHigh)r/   r0   r1   rC   r   r   )r7   
severitiesr'   s      r   r   CVSS2.severities)  s     
oot':':D<T<TUE}!!&)!E("!!%(!E("!!(+!!&) V Z  r   c                 b    [        U R                  5       S   5      S-   U R                  5       -   $ )z
Returns cleaned vector with score in Red Hat notation, e.g. score/vector.

Example: 5.0/AV:L/AC:L/Au:M/C:N/I:P/A:C/E:U/RL:W/CDP:L/TD:H/AR:M
r   r   )strr$   r   rZ   s    r   	rh_vectorCVSS2.rh_vector<  s-     4;;=#$s*T->->-@@@r   c           
          SR                  [         Vs/ s H$  oS-   U R                  R                  US5      -   PM&     sn5      $ s  snf )zc
Returns the temporal vector from the full CVSS vector.

Returns:
    (str): Temporal CVSS vector.
r   r<   rI   )rD   r   r.   rJ   r7   r@   s     r   temporal_vectorCVSS2.temporal_vectorD  sD     xxIYZIYvc\DLL,,VT::IYZ
 	
Z   +Ac           
          SR                  [         Vs/ s H$  oS-   U R                  R                  US5      -   PM&     sn5      $ s  snf )zm
Returns the environmental vector from the full CVSS vector.

Returns:
    (str): Environmental CVSS vector.
r   r<   rI   )rD   r   r.   rJ   r   s     r   environmental_vectorCVSS2.environmental_vectorO  sD     xxI^_I^vc\DLL,,VT::I^_
 	
_r   c                 D  ^ ^^ S mUU U4S jnST R                   [        T R                  5      S.m[         H  nU" U5        M     U(       a  T R                  (       a@  [
         H  nU" U5        M     T R                  (       a  [        T R                  5      OSTS'   U(       a  T R                  (       a@  [         H  nU" U5        M     T R                  (       a  [        T R                  5      OSTS'   U(       a"  [        [        TR                  5       5      5      mT$ )ax  
Returns a dictionary formatted with attribute names and values defined by the official
CVSS JSON schema:

https://www.first.org/cvss/cvss-v2.0.json?20170531

Serialize a CVSS2 instance to JSON with:

json.dumps(cvss2.as_json())

Or get sorted JSON in an OrderedDict with:

json.dumps(cvss2.as_json(sort=True))

Returns:
    (dict): JSON schema-compatible CVSS representation
c                 b    U R                  5       R                  SS5      R                  SS5      $ )N-_ )upperreplace)texts    r   usCVSS2.as_json.<locals>.usm  s(    ::<''S199#sCCr   c                 L   > [         U    nT" TR                  U 5      5      TU'   g r   )r	   rR   )r@   kdatar7   r   s     r   add_metric_to_data)CVSS2.as_json.<locals>.add_metric_to_dataq  s&    *62A33F;<DGr   z2.0)versionvectorString	baseScoreg        temporalScoreenvironmentalScore)r&   r#   r/   r
   r0   r   r1   r   r   sorteditems)r7   sortminimalr   r@   r   r   s   `    @@r   as_jsonCVSS2.as_jsonZ  s    &	D	=
  KKt/
 (Fv& ( $--*"6* +BFBUBUE$*=*=$>[^D!$22/"6* 0 483K3Kd../QT %& vdjjl34Dr   c                 4    [        U R                  5       5      $ r   )hashr   rZ   s    r   __hash__CVSS2.__hash__  s    D%%'((r   c                 p    [        U[        5      (       a!  U R                  5       UR                  5       :H  $ g)NF)
isinstancer   r   )r7   os     r   __eq__CVSS2.__eq__  s-    a$$&!..*:::r   )r/   r1   r.   r0   r&   N)F)FF)__name__
__module____qualname____firstlineno____doc__classmethodr+   r8   r2   r3   rO   rR   r[   rc   ro   r4   rz   r5   r6   r$   r   r   r   r   r   r   r   r   __static_attributes__ r   r   r   r   *   s     % %N+&%Nd	

 
(D
PN*	J !&A	
	
3j)r   r   N)r   
__future__r   decimalr   r   r   
constants2r   r   r	   r
   r   r   r   r   
exceptionsr   r   r   r   r   objectr   r   r   r   <module>r      sA   
 ( !  	 	 	 <kF kr   