Stop creation of CVSS v4 by yourself

首先查看 advisory-database#5032 中的原始讨论和列出的 CVE 示例，然后追踪 CVSS v4 值和严重性是在何处生成的。将生成的值与原始 CVSS 数据以及文档中记录的 advisory 行为进行比较。完成后应能防止计算出的分数和严重性值不正确，并记录 policy 和计算过程。

You seem to to create CVSS v4 scores for some advisories as I found out in https://github.com/github/advisory-database/pull/5032.
I condensed the original discussion into this issue.

There are some problem with that, here is a quick recap:

• This is only done for certain CVEs, not all
• The process how these CVSS v4 values are created is not transparent
  • There is no (public) documentation that this is done, how this is done and why it is done
  • Likely no communication with CVE creators / CVSSv4 values do not match CVE descriptions (usually only contains CVSS v3 score explanation)
• Created CVSS v4 are not marked as "computed from CVSSv3 by GitHub" or something similar anywhere
• Original CVSS score is not used for computing the severity

Please have a look at the original discussion for more details.

Anyway this process seems to result in incorrect scores (some values do not match at all) and incorrect severity values, thus also resulting in False Postives and Negatives in downstream scanners that utilize the database with severity filters.

Spontaneously found examples:

The overall current situation erodes (my) trust in this - security critical - system as distinguishing between correct and incorrect scores is no longer easily possible.

Further references:

• https://github.com/aquasecurity/trivy/discussions/8042