5 ms·

What is the rationale behind GHSA advisory score having a lower score for vulnerability severity than what the security community thinks. I've come across this

What is the rationale behind GHSA advisory score having a lower score for vulnerability severity than what the security community thinks. I've come across this again and again where the CVSS score was higher than the GHSA. Example: GHSA has moderate severity: https://github.com/advisories/GHSA-896r-f27r-55mw https://github.com/advisories/GHSA-896r-f27r-55mw The CVSS3 score of the CVE is actually critical!! If GHSA is "self-reporting" then why is it allowed to deviate in a direction that is harmful (downplaying the issue). If this means what I think it means (and I might be wrong) then the GHSA score is broken. Also it breaks security workflows that build on GHSA: If a manager looking at the conflicting severity levels lowers the urgency of the backlog ticket because severity is only moderate then users might get hurt.

greysteil 5y ago
Oh good question. I can't answer this one as authoritatively as I'd like - I'll double check with the team next week. One thing to note is that the full CVSS 3.1 string is included in the database as assessed by NIST. The severity displayed by GitHub is stored as a "database specific" field, so it looks like we're trying to be explicit about the existence of multiple perspectives on severity (one of which is our own), but that we could do more to make that clear. https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-896r-f27r-55mw/GHSA-896r-f27r-55mw.json https://github.com/github/advisory-database/blob/main/adviso...