vulncheckandClaude Opus 5
6b3744e569
Chrome CVE records carry no metrics block whatsoever — Google puts the severity in the description instead: "… (Chromium security severity: Critical)". Every fresh Chrome finding therefore landed on the neutral 'medium' placeholder, so a Critical sandbox escape sorted level with a Low UI glitch, both in the queue and in the daily digest mail. For a team that triages by severity that is worse than no data. The severity word is now read from the description when no metrics block exists. No score is invented — only what the vendor stated, and a real CVSS always wins over the prose. Once NVD publishes a score, the existing CVSS-sync takes over as before. Existing rows heal on the next scan: the upsert already lifts a finding off the medium placeholder when a source reports a better severity. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
48 lines
1.8 KiB
Python
48 lines
1.8 KiB
Python
"""Chromium severity from prose — run: python tests/test_chromium_severity.py
|
|
|
|
Chrome CVE records carry no metrics block at all. Google states the severity
|
|
in the description instead: "… (Chromium security severity: Critical)". Losing
|
|
it means every fresh Chrome CVE sits at the neutral 'medium' placeholder, so a
|
|
Critical sandbox escape sorts level with a Low UI glitch — in the queue and in
|
|
the digest mail.
|
|
"""
|
|
import os
|
|
import sys
|
|
|
|
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
|
|
|
|
from app.services.cvelistv5_scan_service import _cvss_from_record
|
|
|
|
|
|
def _rec(desc, metrics=None):
|
|
cna = {"descriptions": [{"lang": "en", "value": desc}]}
|
|
if metrics:
|
|
cna["metrics"] = metrics
|
|
return {"containers": {"cna": cna}}
|
|
|
|
|
|
def demo():
|
|
# Verbatim description from CVE-2026-17650.
|
|
crit = _rec("Use after free in Compositing in Google Chrome prior to "
|
|
"151.0.7922.72 allowed a remote attacker who had compromised "
|
|
"the renderer process to potentially perform a sandbox escape "
|
|
"via a crafted HTML page. (Chromium security severity: Critical)")
|
|
assert _cvss_from_record(crit) == (None, "critical")
|
|
|
|
assert _cvss_from_record(_rec("... (Chromium security severity: High)"))[1] == "high"
|
|
assert _cvss_from_record(_rec("... (Chromium security severity: Low)"))[1] == "low"
|
|
|
|
# No such phrase → unchanged behaviour, no severity invented.
|
|
assert _cvss_from_record(_rec("Some other product's flaw.")) == (None, None)
|
|
|
|
# A real score always wins over the prose.
|
|
scored = _rec("... (Chromium security severity: Low)",
|
|
metrics=[{"cvssV3_1": {"baseScore": 9.8, "baseSeverity": "CRITICAL"}}])
|
|
assert _cvss_from_record(scored) == (9.8, "critical")
|
|
|
|
print("chromium severity OK")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
demo()
|