Skip to content

Commit 75888cc

Browse files
coheigeacoheigea
authored
fix: Add support to parse CVSSV4 findings for the Trivy parser (#14379)
1 parent 1806c48 commit 75888cc

3 files changed

Lines changed: 259 additions & 1 deletion

File tree

‎dojo/tools/trivy/parser.py‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,8 @@ def get_result_items(self, test, results, service_name=None, artifact_name=""):
255255
cvssclass = None
256256
cvssv3 = None
257257
cvssv3_score = None
258+
cvssv4 = None
259+
cvssv4_score = None
258260
severity = TRIVY_SEVERITIES[vuln["Severity"]] if vuln.get("Severity") else None
259261
# Iterate over the possible severity sources tom find the first match
260262
for severity_source in [detected_severity_source, *CVSS_SEVERITY_SOURCES]:
@@ -263,7 +265,17 @@ def get_result_items(self, test, results, service_name=None, artifact_name=""):
263265
break
264266
# Parse the CVSS class if it is not None
265267
if cvssclass is not None:
266-
if cvss_data := parse_cvss_data(cvssclass.get("V3Vector", "")):
268+
# First parse the CVSSv4 vector if present, then CVSSv3 vector, then CVSSv3 score, then CVSSv2 score to determine severity and CVSS scores and vectors
269+
if cvss_data := parse_cvss_data(cvssclass.get("V40Vector", "")):
270+
cvssv4 = cvss_data.get("cvssv4")
271+
cvssv4_score = cvss_data.get("cvssv4_score")
272+
if severity is None:
273+
severity = cvss_data.get("severity")
274+
elif (cvss_v4_score := cvssclass.get("V4Score")) is not None:
275+
cvssv4_score = cvss_v4_score
276+
if severity is None:
277+
severity = self.convert_cvss_score(cvss_v4_score)
278+
elif cvss_data := parse_cvss_data(cvssclass.get("V3Vector", "")):
267279
cvssv3 = cvss_data.get("cvssv3")
268280
cvssv3_score = cvss_data.get("cvssv3_score")
269281
if severity is None:
@@ -320,6 +332,8 @@ def get_result_items(self, test, results, service_name=None, artifact_name=""):
320332
component_version=package_version,
321333
cvssv3=cvssv3,
322334
cvssv3_score=cvssv3_score,
335+
cvssv4=cvssv4,
336+
cvssv4_score=cvssv4_score,
323337
static_finding=True,
324338
dynamic_finding=False,
325339
fix_available=fix_available,

‎unittests/scans/trivy/cvssv4_severity_source.json‎

Lines changed: 232 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,232 @@
1+
{
2+
"SchemaVersion": 2,
3+
"Trivy": {
4+
"Version": "0.69.1"
5+
},
6+
"ReportID": "019c8e79-cf0f-75cc-8c6e-b806652074c5",
7+
"CreatedAt": "2026-02-24T07:07:53.487381Z",
8+
"ArtifactName": "lib/catalina.jar",
9+
"ArtifactType": "filesystem",
10+
"Results": [
11+
{
12+
"Target": "Java",
13+
"Class": "lang-pkgs",
14+
"Type": "jar",
15+
"Packages": [
16+
{
17+
"Name": "org.apache.tomcat:tomcat-catalina",
18+
"Identifier": {
19+
"PURL": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.109",
20+
"UID": "ac2f42ab8f82e098"
21+
},
22+
"Version": "9.0.109",
23+
"FilePath": "catalina.jar",
24+
"AnalyzedBy": "jar"
25+
}
26+
],
27+
"Vulnerabilities": [
28+
{
29+
"VulnerabilityID": "CVE-2025-66614",
30+
"VendorIDs": [
31+
"GHSA-fpj8-gq4v-p354"
32+
],
33+
"PkgName": "org.apache.tomcat:tomcat-catalina",
34+
"PkgPath": "catalina.jar",
35+
"PkgIdentifier": {
36+
"PURL": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.109",
37+
"UID": "ac2f42ab8f82e098"
38+
},
39+
"InstalledVersion": "9.0.109",
40+
"FixedVersion": "11.0.14, 10.1.49, 9.0.112",
41+
"Status": "fixed",
42+
"SeveritySource": "ghsa",
43+
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-66614",
44+
"DataSource": {
45+
"ID": "ghsa",
46+
"Name": "GitHub Security Advisory Maven",
47+
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
48+
},
49+
"Fingerprint": "sha256:e57258930e76fa6f68fd091192d82af0c355c745b9e1472000db245e96a5191c",
50+
"Title": "tomcat: Client certificate verification bypass due to virtual host mapping",
51+
"Description": "Improper Input Validation vulnerability.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.\nTomcat did not validate that the host name provided via the SNI \nextension was the same as the host name provided in the HTTP host header \nfield. If Tomcat was configured with more than one virtual host and the \nTLS configuration for one of those hosts did not require client \ncertificate authentication but another one did, it was possible for a \nclient to bypass the client certificate authentication by sending \ndifferent host names in the SNI extension and the HTTP host header field.\n\n\n\nThe vulnerability only applies if client certificate authentication is \nonly enforced at the Connector. It does not apply if client certificate \nauthentication is enforced at the web application.\n\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.",
52+
"Severity": "MEDIUM",
53+
"CweIDs": [
54+
"CWE-20"
55+
],
56+
"VendorSeverity": {
57+
"ghsa": 2,
58+
"redhat": 2
59+
},
60+
"CVSS": {
61+
"ghsa": {
62+
"V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
63+
"V40Score": 6.3
64+
},
65+
"redhat": {
66+
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
67+
"V3Score": 5.3
68+
}
69+
},
70+
"References": [
71+
"https://access.redhat.com/security/cve/CVE-2025-66614",
72+
"https://github.com/apache/tomcat",
73+
"https://github.com/apache/tomcat/commit/152c14885d45f5e0a8b59bd9f93c289cfe20ce30",
74+
"https://github.com/apache/tomcat/commit/258a591b61f8cf5c22109e21e5a2a38b63454fd2",
75+
"https://github.com/apache/tomcat/commit/5053fa82a1b2b52756810601227984a8b71888a4",
76+
"https://github.com/apache/tomcat/commit/9276b5e783c8cd5b3fe2bb716306b65004bdd940",
77+
"https://github.com/apache/tomcat/commit/972f9a5e2a07674d92610c478aac1b205d60724e",
78+
"https://github.com/apache/tomcat/commit/a4aa74232e826028cd2f7ba0445caf8a8b52c509",
79+
"https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7",
80+
"https://nvd.nist.gov/vuln/detail/CVE-2025-66614",
81+
"https://tomcat.apache.org/security-10.html",
82+
"https://tomcat.apache.org/security-11.html",
83+
"https://tomcat.apache.org/security-9.html",
84+
"https://www.cve.org/CVERecord?id=CVE-2025-66614"
85+
],
86+
"PublishedDate": "2026-02-17T19:21:55.31Z",
87+
"LastModifiedDate": "2026-02-18T17:51:53.51Z"
88+
},
89+
{
90+
"VulnerabilityID": "CVE-2025-61795",
91+
"VendorIDs": [
92+
"GHSA-hgrr-935x-pq79"
93+
],
94+
"PkgName": "org.apache.tomcat:tomcat-catalina",
95+
"PkgPath": "catalina.jar",
96+
"PkgIdentifier": {
97+
"PURL": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.109",
98+
"UID": "ac2f42ab8f82e098"
99+
},
100+
"InstalledVersion": "9.0.109",
101+
"FixedVersion": "11.0.12, 10.1.47, 9.0.110",
102+
"Status": "fixed",
103+
"SeveritySource": "ghsa",
104+
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61795",
105+
"DataSource": {
106+
"ID": "ghsa",
107+
"Name": "GitHub Security Advisory Maven",
108+
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
109+
},
110+
"Fingerprint": "sha256:8aa49887a18f888c17b62dc43050457a0c3ce2e2e7a12b5cec90a53fdbfd975d",
111+
"Title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service",
112+
"Description": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.",
113+
"Severity": "LOW",
114+
"CweIDs": [
115+
"CWE-404"
116+
],
117+
"VendorSeverity": {
118+
"alma": 3,
119+
"amazon": 2,
120+
"bitnami": 2,
121+
"ghsa": 1,
122+
"oracle-oval": 3,
123+
"redhat": 2,
124+
"rocky": 3
125+
},
126+
"CVSS": {
127+
"bitnami": {
128+
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
129+
"V3Score": 5.3
130+
},
131+
"ghsa": {
132+
"V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
133+
"V40Score": 2.3
134+
},
135+
"redhat": {
136+
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
137+
"V3Score": 5.3
138+
}
139+
},
140+
"References": [
141+
"http://www.openwall.com/lists/oss-security/2025/10/27/6",
142+
"https://access.redhat.com/errata/RHSA-2025:23050",
143+
"https://access.redhat.com/security/cve/CVE-2025-61795",
144+
"https://bugzilla.redhat.com/2362782",
145+
"https://bugzilla.redhat.com/2406588",
146+
"https://bugzilla.redhat.com/2406591",
147+
"https://bugzilla.redhat.com/show_bug.cgi?id=2362782",
148+
"https://bugzilla.redhat.com/show_bug.cgi?id=2406588",
149+
"https://bugzilla.redhat.com/show_bug.cgi?id=2406591",
150+
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651",
151+
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55752",
152+
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61795",
153+
"https://errata.almalinux.org/10/ALSA-2025-23050.html",
154+
"https://errata.rockylinux.org/RLSA-2025:23050",
155+
"https://github.com/apache/tomcat",
156+
"https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06",
157+
"https://github.com/apache/tomcat/commit/af6e9181620304c0d818121c29c074e1330610d0",
158+
"https://github.com/apache/tomcat/commit/afa422bd7ca1eef0f507259c682fd876494d9c3b",
159+
"https://linux.oracle.com/cve/CVE-2025-61795.html",
160+
"https://linux.oracle.com/errata/ELSA-2025-23050.html",
161+
"https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp",
162+
"https://nvd.nist.gov/vuln/detail/CVE-2025-61795",
163+
"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.47",
164+
"https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.12",
165+
"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.110",
166+
"https://www.cve.org/CVERecord?id=CVE-2025-61795"
167+
],
168+
"PublishedDate": "2025-10-27T18:15:44.2Z",
169+
"LastModifiedDate": "2025-11-14T16:53:33.3Z"
170+
},
171+
{
172+
"VulnerabilityID": "CVE-2026-24733",
173+
"VendorIDs": [
174+
"GHSA-qq5r-98hh-rxc9"
175+
],
176+
"PkgName": "org.apache.tomcat:tomcat-catalina",
177+
"PkgPath": "catalina.jar",
178+
"PkgIdentifier": {
179+
"PURL": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.109",
180+
"UID": "ac2f42ab8f82e098"
181+
},
182+
"InstalledVersion": "9.0.109",
183+
"FixedVersion": "11.0.14, 10.1.49, 9.0.112",
184+
"Status": "fixed",
185+
"SeveritySource": "ghsa",
186+
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-24733",
187+
"DataSource": {
188+
"ID": "ghsa",
189+
"Name": "GitHub Security Advisory Maven",
190+
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
191+
},
192+
"Fingerprint": "sha256:84e870b1cb52f3774ad444746a88d2ead3586eacbc8b90b16c87e950314549ee",
193+
"Title": "tomcat: security constraint bypass with HTTP/0.9",
194+
"Description": "Improper Input Validation vulnerability in Apache Tomcat.\n\n\nTomcat did not limit HTTP/0.9 requests to the GET method. If a security \nconstraint was configured to allow HEAD requests to a URI but deny GET \nrequests, the user could bypass that constraint on GET requests by \nsending a (specification invalid) HEAD request using HTTP/0.9.\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.\n\n\nOlder, EOL versions are also affected.\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.",
195+
"Severity": "LOW",
196+
"CweIDs": [
197+
"CWE-20"
198+
],
199+
"VendorSeverity": {
200+
"ghsa": 1,
201+
"redhat": 1
202+
},
203+
"CVSS": {
204+
"ghsa": {
205+
"V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
206+
"V40Score": 2.7
207+
},
208+
"redhat": {
209+
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
210+
"V3Score": 5.3
211+
}
212+
},
213+
"References": [
214+
"https://access.redhat.com/security/cve/CVE-2026-24733",
215+
"https://github.com/apache/tomcat",
216+
"https://github.com/apache/tomcat/commit/2e2fa23f2635bbb819759576a2f2f5e64ecf7c5f",
217+
"https://github.com/apache/tomcat/commit/6c73d74ff281260d74c836370ff6b82f1da8048b",
218+
"https://github.com/apache/tomcat/commit/711b465cf22684a1acf0cb43501cdbbce9b6c5f4",
219+
"https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f",
220+
"https://nvd.nist.gov/vuln/detail/CVE-2026-24733",
221+
"https://tomcat.apache.org/security-10.html",
222+
"https://tomcat.apache.org/security-11.html",
223+
"https://tomcat.apache.org/security-9.html",
224+
"https://www.cve.org/CVERecord?id=CVE-2026-24733"
225+
],
226+
"PublishedDate": "2026-02-17T19:21:56.82Z",
227+
"LastModifiedDate": "2026-02-18T17:51:53.51Z"
228+
}
229+
]
230+
}
231+
]
232+
}

‎unittests/tools/test_trivy_parser.py‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -345,3 +345,15 @@ def test_misconfig_fields(self):
345345
findings = parser.get_findings(test_file, Test())
346346
self.assertEqual(len(findings), 1)
347347
self.assertEqual("Low", findings[0].severity)
348+
349+
def test_cvssv4_severity_sources(self):
350+
"""Testing with three findings with CVSSv4 scores"""
351+
with sample_path("cvssv4_severity_source.json").open(encoding="utf-8") as test_file:
352+
parser = TrivyParser()
353+
findings = parser.get_findings(test_file, Test())
354+
self.assertEqual(len(findings), 3)
355+
with self.subTest("CVSSv4 finding"):
356+
finding = findings[0]
357+
self.assertEqual("Medium", finding.severity)
358+
self.assertEqual("CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", finding.cvssv4)
359+
self.assertEqual(6.3, finding.cvssv4_score)

0 commit comments

Comments
 (0)