Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Stop creation of CVSS v4 by yourself

Open
#5,058 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
20/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Domain
security

Research direction

Start by reviewing the original discussion in advisory-database#5032 and the listed CVE examples, then trace where CVSS v4 values and severity are produced. Compare the generated values with the original CVSS data and documented advisory behavior. Done should prevent incorrect computed scores and severity values, with the policy and computation process documented.

Written by the indexing model from the issue text.

Description

You seem to to create CVSS v4 scores for some advisories as I found out in https://github.com/github/advisory-database/pull/5032.
I condensed the original discussion into this issue.

There are some problem with that, here is a quick recap:

  • This is only done for certain CVEs, not all
  • The process how these CVSS v4 values are created is not transparent
    • There is no (public) documentation that this is done, how this is done and why it is done
    • Likely no communication with CVE creators / CVSSv4 values do not match CVE descriptions (usually only contains CVSS v3 score explanation)
  • Created CVSS v4 are not marked as "computed from CVSSv3 by GitHub" or something similar anywhere
  • Original CVSS score is not used for computing the severity

Please have a look at the original discussion for more details.

Anyway this process seems to result in incorrect scores (some values do not match at all) and incorrect severity values, thus also resulting in False Postives and Negatives in downstream scanners that utilize the database with severity filters.

Spontaneously found examples:

CVE CVSS v3 (original) CVSS v4 created by GitHub (used in severity) Note
CVE-2024-47535 5.5 moderate 7.0 High See https://github.com/github/advisory-database/pull/5032
CVE-2024-53848 7.1 High 6.1 Moderate Vulnerable System Impact Metrics seem to be missing
CVE-2024-52806 8.3 High 6.9 Medium Vulnerable System Impact Metrics seem to be missing
CVE-2024-51132 9.8 Critical 8.8 High Subsequent System Impact Metrics seem to be missing
CVE-2024-43499 7.5 High 0.0 Low CVSSv3 is not present in database but was declared in CVE? Not sure what's going on here...
CVE-2024-50379 9.8 Critical 7.2 High Subsequent System Impact Metrics seem to be missing

The overall current situation erodes (my) trust in this - security critical - system as distinguishing between correct and incorrect scores is no longer easily possible.

Further references:

Dominant language
No language data
Stars
2.5k
Forks
772
Avg merge
3d 15h
Merged PRs (30d)
46

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/advisory-database

All issues in github/advisory-database

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.