Skip to content

Commit

Permalink
Update readme.md
Browse files Browse the repository at this point in the history
  • Loading branch information
orf committed Nov 2, 2015
1 parent 536d188 commit 38b1c5b
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion docs/readme.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Code

I've had the misfortune of having to write several CVSS libraries in Python, this is my latest attempt at one that is tested and re-usable. Due to the nature of the CVSS v2 and v3 specifications (terrible 'reference code', huge amount of state and fiddly maths + corner cases) the current open source Python libraries for manipulating cvss are somewhat terrible and unmaintained. The only current implementation of v3 [has a (broken) 300 line function full of conditionals to handle vectors](https://github.com/toolswatch/pycvss3/blob/master/lib/pycvss3.py#L36), and while [some that implement v2](https://github.com/esn89/cvss-v2-calc) have better code quality they still lack tests and an importable API.
I've had the misfortune of having to write several CVSS libraries in Python, this is my latest attempt at one that is tested and re-usable. Due to the nature of the CVSS v2 and v3 specifications (terrible 'reference code', huge amount of state and fiddly maths + corner cases) the current open source Python libraries for manipulating cvss are somewhat terrible and unmaintained. The only current implementation of v3 [has a (broken) 300 line function full of conditionals to handle vectors](https://github.com/toolswatch/pycvss3/blob/master/lib/pycvss3.py#L36), and while [some that implement v2](https://github.com/esn89/cvss-v2-calc) have better code quality they still lack tests and an importable API. There are a couple that are quite nice, including (cvss_util)[https://bitbucket.org/asecurityteam/cvss_util]

There is also a lack of a useful reference implementation. There is an official calculator for v2 and v3, but these are useless for automated testing. The v3 is all in JavaScript (and unpublished I might add, so you have to dig through the undocumented page JS), and you would need to screen-scrape the NIST website to automate the v2 calculator. Eww.

Expand Down

0 comments on commit 38b1c5b

Please sign in to comment.