I noticed when running the Rake task on nokogiri (bundle exec rake "sync_github_advisories[nokogiri]") to pull in some recent GHSAs that the CVSS score was not populated automatically, despite the advisories (their global versions, at least) having CVSS v4 scores. e.g. GHSA-5prr-v3j2-97mh
The GraphQL query in lib/github_advisory_sync.rb requests the deprecated advisory.cvss field, which only has the CVSS v3 score. If an advisory is scored with only the v4 score, then we end up with a nil value and the YAML file gets no score at all.
The CVSS v4 score is only available in the GraphQL API via cvssSeverities { cvssV4 { score vectorString } }, so we should update the Ruby code to query for that value.
We should also probably stop pulling the v3 score from the deprecated value and instead get it from cvssSeverities.
I noticed when running the Rake task on nokogiri (
bundle exec rake "sync_github_advisories[nokogiri]") to pull in some recent GHSAs that the CVSS score was not populated automatically, despite the advisories (their global versions, at least) having CVSS v4 scores. e.g. GHSA-5prr-v3j2-97mhThe GraphQL query in
lib/github_advisory_sync.rbrequests the deprecatedadvisory.cvssfield, which only has the CVSS v3 score. If an advisory is scored with only the v4 score, then we end up with anilvalue and the YAML file gets no score at all.The CVSS v4 score is only available in the GraphQL API via
cvssSeverities { cvssV4 { score vectorString } }, so we should update the Ruby code to query for that value.We should also probably stop pulling the v3 score from the deprecated value and instead get it from
cvssSeverities.