nix-security-tracker
nix-security-tracker copied to clipboard
Extract severity from the `metrics` JSON object
Required for https://github.com/Nix-Security-WG/nix-local-security-scanner/issues/51
In CVEs the data could look something like this:
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
}
},
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
}
}
],
but at the time of writing our data model for that is
class Metric(models.Model):
"""Class representing an impact information related to a CVE record."""
format = models.CharField(max_length=64)
scenarios = models.ManyToManyField(Description)
content = models.JSONField()
class Container(models.Model):
# ...
metrics = models.ManyToManyField(Metric)