Score an advisory from the highest CVSS vector we can compute - #25
Merged
Merged
Conversation
Every advisory published since the middle of 2026 arrives carrying both a CVSS 4.0 vector and a 3.1 one, and severity extraction took the highest version present, which is 4.0, whose base score this module cannot compute: 4.0 scoring is a lookup table rather than a formula, and this module has no dependencies by design. Twenty of the twenty eight advisories therefore showed no score at all, despite a scorable 3.1 vector sitting beside the one we kept, and since the page orders by base score those twenty sorted as though they were the least severe. The vector and the score are now taken from the same entry, the highest version that yields a number, so nothing is quoted from one version of the standard beside another version's figure.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Twenty of the twenty eight advisories on https://www.pgadmin.org/security/ show no score, and because the page orders by base score they sort as though they were the least severe. It is all the recent ones.
Every advisory published since the middle of 2026 arrives carrying both a CVSS 4.0 vector and a 3.1 one, and severity extraction took the highest version present. We cannot compute a 4.0 base score: its scoring is a lookup table rather than a formula, and this module has no dependencies by design. So those advisories kept the 4.0 vector and lost the number, despite a perfectly scorable 3.1 vector sitting beside it.
The vector and the score now come from the same entry, the highest version that actually yields a number, so the page never quotes one version's metrics beside another version's figure.
Verified against the live OSV response: all 28 advisories now carry a base score and a severity band, and the four most recent come out 6.5, 7.0, 8.1 and 6.5 from their 3.1 vectors.
Implementing 4.0 scoring properly would mean roughly 270 macrovector lookup entries plus interpolation, which is a poor trade against showing the 3.1 figure; if OSV ever publishes 4.0-only advisories for pgAdmin, a dependency would be the honest answer.