// NewVulnerability creates a Vulnerability document from a match and the metadata provider
NewVulnerability creates a Vulnerability document from a match and the metadata provider
// NewVulnerability creates a Vulnerability document from a match and the metadata provider
func NewVulnerability(m match.Match, p vulnerability.MetadataProvider) (Vulnerability, error) {
	metadata, err := p.GetMetadata(m.Vulnerability.ID, m.Vulnerability.Namespace)
	if err != nil {
		return Vulnerability{}, fmt.Errorf("unable to fetch vuln=%q metadata: %+v", m.Vulnerability.ID, err)
	}
	severity := metadata.Severity
	if metadata.Severity == "Negligible" {
		severity = "Low"
	}
	var ratings = []Rating{
		{
			Severity: severity,
		},
	}
	for _, cvss := range metadata.Cvss {
		var rating Rating
		score := &Score{
			Base: cvss.Metrics.BaseScore,
		}
		if cvss.Metrics.ExploitabilityScore != nil {
			score.Exploitability = *cvss.Metrics.ExploitabilityScore
		}
		if cvss.Metrics.ImpactScore != nil {
			score.Impact = *cvss.Metrics.ImpactScore
		}
		rating.Score = score
		method, err := cvssVersionToMethod(cvss.Version)
		if err != nil {
			log.Errorf("unable to parse CVSS version: %v", err)
			continue
		}
		rating.Method = method
		rating.Vector = cvss.Vector
		ratings = append(ratings, rating)
	}
	v := Vulnerability{
		Ref: uuid.New().URN(),
		ID:  m.Vulnerability.ID,
		Source: Source{
			Name: m.Vulnerability.Namespace,
			URL:  makeVulnerabilityURL(m.Vulnerability.ID),
		},
		Ratings:     ratings,
		Description: metadata.Description,
		Advisories: &Advisories{
			Advisory: metadata.URLs,
		},
	}
	return v, nil
}
func NewVulnerability ( m match . Match , p vulnerability . MetadataProvider ) ( Vulnerability , error ) { metadata , err := p . GetMetadata ( m . Vulnerability . ID , m . Vulnerability . Namespace ) if err != nil { return Vulnerability { } , fmt . Errorf ( " " , m . Vulnerability . ID , err ) } severity := metadata . Severity if metadata . Severity == " " { severity = " " } var ratings = [ ] Rating { { Severity : severity , } , } for _ , cvss := range metadata . Cvss { var rating Rating score := & Score { Base : cvss . Metrics . BaseScore , } if cvss . Metrics . ExploitabilityScore != nil { score . Exploitability = * cvss . Metrics . ExploitabilityScore } if cvss . Metrics . ImpactScore != nil { score . Impact = * cvss . Metrics . ImpactScore } rating . Score = score method , err := cvssVersionToMethod ( cvss . Version ) if err != nil { log . Errorf ( " " , err ) continue } rating . Method = method rating . Vector = cvss . Vector ratings = append ( ratings , rating ) } v := Vulnerability { Ref : uuid . New ( ) . URN ( ) , ID : m . Vulnerability . ID , Source : Source { Name : m . Vulnerability . Namespace , URL : makeVulnerabilityURL ( m . Vulnerability . ID ) , } , Ratings : ratings , Description : metadata . Description , Advisories : & Advisories { Advisory : metadata . URLs , } , } return v , nil }
NewVulnerability creates a Vulnerability document from a match and the metadata provider
NewVulnerability creates a Vulnerability document from a match and the metadata provider
// The schema does not allow "Negligible", only allowing the following: // 'None', 'Low', 'Medium', 'High', 'Critical', 'Unknown' // do not halt execution if one CVSS fails to provide an accurate Version