CjRJSrSSKJr SSKrSSKJr SSKJr SSKJ r J r J r J r J r JrJrJr SSKJrJrJrJr S r"S S \5rg) z Implements class for CVSS3 specification as defined at https://www.first.org/cvss/specification-document . The library is compatible with both Python 2 and Python 3. )unicode_literalsN) ROUND_CEILING)Decimal)ENVIRONMENTAL_METRICSMETRICS_ABBREVIATIONSMETRICS_ABBREVIATIONS_JSONMETRICS_MANDATORYMETRICS_VALUE_NAMESMETRICS_VALUESTEMPORAL_METRICS OrderedDict)CVSS3MalformedErrorCVSS3MandatoryErrorCVSS3RHMalformedErrorCVSS3RHScoreDoesNotMatchc<UR[S5[S9$)z Round up is defined as the smallest number, specified to one decimal place, that is equal to or higher than its input. For example, Round up (4.02) is 4.1; and Round up (4.00) is 4.0. z0.1)rounding)quantizeDr)values \/home/rurouni/.local/share/pipx/venvs/strix-agent/lib/python3.13/site-packages/cvss/cvss3.pyround_upr$s >>!E(]> ;;c\rSrSrSr\S5rSrSrSr Sr Sr S r S r S rS rS rSrSrSrSrSrSrSrSrS SjrSrSrSrSrS!SjrSrSr Sr!g)"CVSS3,z< Class to hold CVSS3 vector, parsed values, and all scores. c~URSS5up#[ U5nU"U5nUR 5SU:XaU$[ SRX5R 5SU55e![a [SRU55ef=f![a [SRU55ef=f)a Creates a CVSS3 object from CVSS vector in Red Hat notation, e.g. containing base score. Also checks if the score matches the vector. Args: vector (str): string specifying CVSS3 vector in Red Hat notation, fields may be out of order, fields which are not mandatory may be missing Returns: CVSS3: the generated CVSS3 object created from the vector string Raises: CVSS3RHMalformedError: if vector is not in expected format for Red Hat notation CVSS3RHScoreDoesNotMatch: if vector and score do not match /rz0Malformed CVSS3 vector in Red Hat notation "{0}"rzgCVSS3 vector in Red Hat notation "{0}" has score of "{1}" which does not match specified score of "{2}")split ValueErrorrformatfloatscoresr)clsvectorscore base_vector score_value cvss_objects rfrom_rh_vectorCVSS3.from_rh_vector1s" !'c1!5 E  ,K +&     "k 1 *FFLf!3!3!5a!8%G  'BII&Q    'BII&Q  sA/ B/%B%B<cXlSUl0UlSUl/UlSUlSUlSUlSUlSUl SUl SUl SUl SUl SUlSUlUR!5 UR#5 UR%5 UR'5 UR)5 UR+5 UR-5 g)z Args: vector (str): string specifying CVSS3 vector, fields may be out of order, fields which are not mandatory may be missing N)r& minor_versionmetricsoriginal_metricsmissing_metricsscopemodified_scope base_scoretemporal_scoreenvironmental_scoreisc_baseiscescmodified_isc_base modified_isc modified_esc parse_vectorcheck_mandatory handle_scopeadd_missing_optionalcompute_base_scorecompute_temporal_scorecompute_environmental_score)selfr&s r__init__CVSS3.__init__Ys  ! $! ""#'  !%      !!# ! ##% ((*rcURS:Xa [S5eURRS5(a [S5eURRS5(aSUlOLURRS5(aSUlO$[S R UR55eURR S5SS nUHnUS:Xa$[S R UR55eUR S 5up4U[;a`U[U;a9X0R;a[SR U55eX@RU'M[SR XB55e[SR X255e g ![a% [S R UR55ef=f![a [SR U55ef=f)zm Parses metrics from the CVSS3 vector. Raises: CVSS3MalformedError: if vector is not in expected format z'Malformed CVSS3 vector, vector is emptyrz$Malformed CVSS3 vector, trailing "/"z CVSS:3.0/rz CVSS:3.1/rzYMalformed CVSS3 vector "{0}" is missing mandatory prefix or uses unsupported CVSS versionNzMalformed CVSS3 vector "{0}"z!Empty field in CVSS3 vector "{0}":zMalformed CVSS3 field "{0}"zDuplicate metric "{0}"z"Unknown value "{0}" in field "{1}"z#Unknown metric "{0}" in field "{1}") r&rendswith startswithr.r"r IndexErrorr!rr r/)rDfieldsfieldmetricrs rr=CVSS3.parse_vectorzs ;;" %&OP P ;;   $ $%&LM M ;; ! !+ . .!"D  [[ # #K 0 0!"D %3396$++3F   Z[[&&s+AB/F E{)*M*T*TUYU`U`*abb W % C 0 ..N622-12J2Q2QRX2YZZ+0LL(-<CCEQ*9@@O'  Z%&D&K&KDKK&XY Y Z W)*G*N*Nu*UVV Ws<F$ G$/G%G;cURSUlURRSS5UlURS;aURUlgg)zC Sets scope and modified scope variables based on S and MS metrics SMSN)NX)r/r2getr3rDs rr?CVSS3.handle_scopesL\\#& "ll..tT:   + -"&**D  .rc/n[H%nX R;dMURU5 M' U(a)[SR SR U555eg)z Checks if mandatory fields are in CVSS3 vector. Raises: CVSS3MandatoryError: if mandatory metric is missing in the vector zMissing mandatory metrics "{0}"z, N)r r/appendrr"join)rDmissingmandatory_metrics rr>CVSS3.check_mandatorysV 1 ||3/0!2 %&G&N&NtyyY`Oa&bc c rc[R"UR5UlSHFnXR;dURUS:XdM'URUSSURU'MH g)z Adds missing optional parameters, so they match the mandatory ones. Original metrics are also stored, as they may be used for printing back the minimal vector. )MAVMACMPRMUIMCrSMIMArTrN)copyr/r0)rD abbreviations rr@CVSS3.add_missing_optionals] !% $,, 7PL<</4<< 3MQT3T-1\\,qr:J-K \*QrcURRUS5nUS:XaURS:XdUS:Xa7URS:Xa'S[ S5[ S5[ S5S .UnU$[ UUnU$) z Gets value of specific metric specified by its abbreviation. Handles exception for Privileges Required based on Scope or Modified scope. rTPRCraNz0.85z0.68z0.50)rTNLH)r/rUr2r3rr rDrg string_valueresults r get_valueCVSS3.get_values ||'' c: D TZZ3%6 E !d&9&9S&@aiaiaiPQ]^F $L1,?F rcVURRUS5n[UUnU$)zL Gets textual description of specific metric specified by its abbreviation. rT)r/rUr ros rget_value_descriptionCVSS3.get_value_descriptions.||'' c: $\2<@ rc[S5[S5URS5- [S5URS5- -[S5URS5- -- Ulg)zD ISCBase = 1 - [(1-ImpactConf) x (1-ImpactInteg) x (1-ImpactAvail)] 1rkIAN)rrrr7rVs rcompute_isc_baseCVSS3.compute_isc_bases]# sVdnnS) )vs++ -vs++ -  rc|URS:Xa[S5UR-Ulg URS:Xa[[S5UR[S5- -[S5UR[S5- [S5--- Ulg [ S R UR55e) z` Scope Unchanged 6.42 x ISCBase Scope Changed 7.52 x [ISCBase-0.029] - 3.25 x [ISCBase-0.02]^15 U6.42rk7.520.0293.250.0215zInvalid Scope: "{0}"N)r2rr7r8 RuntimeErrorr"rVs r compute_iscCVSS3.compute_iscs :: y4==0DH ZZ3 yDMMAgJ$>?!F) & )4OCDH5<>Z^K_ _ rc j[[S5[S5URS5URS5-- [S5URS5URS5-- -[S5URS5URS5-- -- [S55Ulg ) zW ISCModified = Minimum[[1-(1-M.IConf x CR)x(1-M.IInteg x IR)x(1-M.IAvail x AR)],0.915] rxrcCRrdIRreARz0.915N)rrrrr:rVs rcompute_modified_isc_baseCVSS3.compute_modified_isc_base%s "%#S6DNN404>>$3GGGS6DNN404>>$3GGGIS6DNN404>>$3GGGII gJ" rcURS:Xa[S5UR-Ulg[S5UR[S5- -[S5UR[S5- [S5--- Ulg) z This is CVSS:3.0 version If Modified Scope Unchanged 6.42 x [ISCModified] If Modified Scope Changed 7.52 x [ISCModified-0.029] - 3.25 x [ISCModified-0.02]^15 r~rrrrrrNr3rr:r;rVs rcompute_modified_isc_30CVSS3.compute_modified_isc_304s|   # % !& D,B,B BD  !& T-C-Caj-P QTUV\T]&&624aU!D rc,URS:Xa[S5UR-Ulg [S5UR[S5- -[S5UR[S5-[S5- [S5--- Ulg ) z This is CVSS:3.1 version If Modified Scope Unchanged 6.42 x [ISCModified] If Modified Scope Changed 7.52 x (ISCModified - 0.029) - 3.25 x (ISCModified x 0.9731 - 0.02)^13 r~rrrrz0.9731r13NrrVs rcompute_modified_iscCVSS3.compute_modified_iscBs   # % !& D,B,B BD  !& T-C-Caj-P QTUV\T]&&84qy@4aU!D rc[S5URS5-URS5-URS5-URS5-Ulg)zV 8.22 x M.AttackVector x M.AttackComplexity x M.PrivilegeRequired x M.UserInteraction rr_r`rarbN)rrrr<rVs rcompute_modified_escCVSS3.compute_modified_escQs[ fInnU# $nnU# $nnU# $nnU#  $ rcUR5 URS:XaUR5 OUR5 UR 5 UR [ S5::a[ S5Ulg URS:Xa6[[UR UR-[ S555nOA[[[ S5UR UR--[ S555n[XRS5-URS5-URS5-5Ulg ) a If (Modified Impact Sub score =< 0) 0 else, If Modified Scope Unchanged Round up(Round up (Minimum [ (M.Impact + M.Exploitability),10]) x Exploit Code Maturity x Remediation Level x Report Confidence) If Modified Scope Changed Round up(Round up (Minimum [1.08 x (M.Impact + M.Exploitability),10]) x Exploit Code Maturity x Remediation Level x Report Confidence)) rrr~rrrrrN) rr.rrrr;rr6r3rrr<rr)rDmodifieds rrC!CVSS3.compute_environmental_score]s &&(    "  ( ( *  % % ' !!#   % ('(xD $""c)#C):):T=N=N)NQRSWQX$YZ#& T%6%69J9J%JKQtWU(0>>#..1EEW[H\\(D $rc~[UR5[UR5[UR54$)zo Returns all computed scores. Returns: (tuple of floats): Base Score, Temporal Score, Environmental Score )r#r4r5r6rVs rr$ CVSS3.scoress0T__%uT-@-@'A5IaIaCbbbrc"/n[HKnX0R;dMURUnUS:wdM+URSRX455 MM U(aSRUR5nOSnUSR U5-$)z Returns vector without optional metrics marked as X and in preferred order. Args: output_prefix (bool): defines if CVSS vector should be printed with prefix Returns: (str): cleaned CVSS3 with metrics in correct order rTz{0}:{1}z CVSS:3.{0}/rHr)rr0rYr"r.rZ)rD output_prefixr&rOrprefixs r clean_vectorCVSS3.clean_vectors+F...--f5C<MM)"2"26"AB , "))$*<*<=FF(((rc/nURURUR4HnU[S5:XaUR S5 M%U[S5::aUR S5 MGU[S5::aUR S5 MiU[S5::aUR S5 MUR S 5 M [ U5$) z Returns severities based on scores. Returns: (tuple): Base Severity, Temporal Severity, Environmental Severity as strings rNonez3.9Lowz6.9Mediumz8.9HighCritical)r4r5r6rrYtuple)rD severitiesr's rrCVSS3.severitiess oot':':D->-@@@rc SR[Vs/sH$oS-URRUS5-PM& sn5$s snf)zc Returns the temporal vector from the full CVSS vector. Returns: (str): Temporal CVSS vector. rrIrT)rZr r/rUrDrOs rtemporal_vectorCVSS3.temporal_vectorsDxxHX YHXfc\DLL,,VS9 9HX Y  Y+Ac SR[Vs/sH$oS-URRUS5-PM& sn5$s snf)zm Returns the environmental vector from the full CVSS vector. Returns: (str): Environmental CVSS vector. rrIrT)rZrr/rUrs renvironmental_vectorCVSS3.environmental_vectorsDxxH] ^H]fc\DLL,,VS9 9H] ^  ^rc^^^ Sm UUU 4SjnTR5upEnS[TR5-TRS.m[H nU"U5 M [ TR 5TS'T "U5TS'U(a[U4Sj[55(a8[H nU"U5 M [ TR5TS'T "U5TS 'U(a[U4S j[55(a8[H nU"U5 M [ TR5TS 'T "U5TS 'U(a"[[TR555mT$) a Returns a dictionary formatted with attribute names and values defined by the official CVSS JSON schema: CVSS v3.0: https://www.first.org/cvss/cvss-v3.0.json?20170531 CVSS v3.1: https://www.first.org/cvss/cvss-v3.1.json?20190610 Serialize a `cvss` instance to JSON with: json.dumps(cvss.as_json()) Or get sorted JSON in an OrderedDict with: json.dumps(cvss.as_json(sort=True)) Returns: (dict): JSON schema-compatible CVSS representation cpUS:XagUR5RSS5RSS5$)NAdjacentADJACENT_NETWORK-_ )upperreplace)texts rusCVSS3.as_json..uss5z!)::<''S199#sC CrcL>[UnT"TRU55TU'gN)r ru)rOkdatarDrs radd_metric_to_data)CVSS3.as_json..add_metric_to_datas&*62A33F;# UHoTR;v M g7frr0.0rOrDs r CVSS3.as_json..s]L\&(=(==L\ temporalScoretemporalSeverityc3@># UHoTR;v M g7frrrs rrrsbLa&(=(==LarenvironmentalScoreenvironmentalSeverity)rrr.r&r r#r4anyr r5rr6rsorteditems) rDsortminimalr base_severitytemporal_severityenvironmental_severityrOrrs ` @@ras_json CVSS3.as_jsons3( D =DH??CT@ *@c$"4"455 KK  (F v &(!$//2[!-0^#]L\]]]*"6*+$)$*=*=$>D !')*;'r@rrrur{rrrArBrrrrrCr$rrrrrrrr__static_attributes__rrrr,s%%N+B3j- dL   J  \&       !Fc),!*A    :x)rr)r __future__rrfdecimalrrr constants3rrr r r r r r exceptionsrrrrrobjectrrrrr sD ( !    <hFhr