cravex2-reachability: Collect available SSVC in VulnerableCode/cravex2-reachability #1963

Activity

1. pombredanne

   added this to 00-AboutCodePlanneron Jul 23, 2025
2. pombredanne

   added a parent issue on Jul 23, 2025

   • cravex2-reachability: Evaluate and implement rule-based tools for triaging vulnerabilities #1961
3. pombredanne

   moved this to Needs prep in 00-AboutCodePlanneron Aug 1, 2025
4. pombredanne

   assigned

   TG1999

   on Aug 1, 2025
5. TG1999

   moved this from Needs prep to In prep in 00-AboutCodePlanneron Aug 6, 2025
6. TG1999 commented on Aug 8, 2025

   

   TG1999

   on Aug 8, 2025

   Last edited by pombredanne

   Contributor

   More actions

   The design is overall like this:

   class SSVC:
      vector
      options
      advisory
      decision
   

   In dejacode, we get a package, and it's vulnerable to a known advisory ID, we can send the SSVC's options and decision to the user, and give the reference to SSVC calculator to show how we came up to the decision.
7. TG1999

   moved this from In prep to Todo ready in 00-AboutCodePlanneron Aug 12, 2025
8. TG1999

   moved this from Todo ready to In progress in 00-AboutCodePlanneron Oct 3, 2025
9. TG1999 commented on Dec 9, 2025

   

   TG1999

   on Dec 9, 2025

   Last edited by pombredanne

   Contributor

   More actions

   Here is a design refinement:

   Problem:

   How shall we store and relate SSVC scores and trees to advisories

   Explanation:

   We have a vulnrichment importer that today imports SSVC as scores in severity and do not store decision and tree with it, only stores the vector.

   What we thought initially was to store SSVC in a separate table and relate it to advisories that share the alias/advisory ID, but the issue is that those SSVC does not come from those advisories with which we are trying to relate those SSVCs, so it would be wrong to show those SSVCs. So what shall we do?

   Probable Solutions:

   • Store SSVC in the separate table with the original CVE that's coming from the importer, and do not relate it to any advisory

   • In UI show some tooltip stating that the SSVC does not come from the advisory source it's coming from this URL and it's just a computed relation. In API document that and also show the original SSVC source data URL
10. TG1999

    closed this as completedin #2050on Dec 15, 2025
11. github-project-automation

    moved this from In progress to Done in 00-AboutCodePlanneron Dec 15, 2025
12. TG1999 commented on Dec 15, 2025

    

    TG1999

    on Dec 15, 2025

    Last edited by pombredanne

    Contributor

    More actions

    Support for SSVC in VulnerableCode is completed.

    The main tracking PR is:

    • Collect SSVC trees #2050

    The SSVCs are stored in this model:

    • https://github.com/aboutcode-org/vulnerablecode/pull/2050/changes#diff-7f9f2c92e7163b06d21fa139369d75caed6561d0368b60ea2516cece0220eb5bR3419

    • We display the SSVC as vector and a crude tree in the UI:

    

    • We return the SSVC as vector and tree data in the API:

    
13. pombredanne

    assigned

    pombredanne

    and unassigned

    TG1999

    on Dec 17, 2025
14. tsteenbe

    moved this from Done to Validated in 00-AboutCodePlanneron Dec 30, 2025
15. hesa

    changed the title [-]cravex2-reachability: Collect available SSVC in VulnerableCode[/-] [+]cravex2-reachability: Create code to collect and store SSVC decision trees in VulnerableCode[/+] on Sep 23, 2026
16. hesa

    changed the title [-]cravex2-reachability: Create code to collect and store SSVC decision trees in VulnerableCode[/-] [+]cravex2-reachability: Collect available SSVC in VulnerableCode/cravex2-reachability[/+] on Sep 23, 2026