fix: add validation for cvss severity scores

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

vulnerabilities/importer.py

@@ -33,6 +33,9 @@
 
 from vulnerabilities import severity_systems
 from vulnerabilities.oval_parser import OvalParser
+from vulnerabilities.severity_systems import CVSSV3
+from vulnerabilities.severity_systems import CVSSV4
+from vulnerabilities.severity_systems import CVSSV31
 from vulnerabilities.severity_systems import SCORING_SYSTEMS
 from vulnerabilities.severity_systems import ScoringSystem
 from vulnerabilities.utils import classproperty
@@ -67,6 +70,15 @@ def __post_init__(self):
         if not isinstance(self.value, str):
             self.value = str(self.value)
 
+        if self.scoring_elements and self.system in [CVSSV3, CVSSV31, CVSSV4]:
+            cvss_score = self.system.compute(self.scoring_elements)
+            if not self.value:
+                self.value = cvss_score
+            elif float(cvss_score) != float(self.value):
+                raise ValueError(
+                    f"CVSS vector and score do not match: {self.scoring_elements} != {self.value}"
+                )
+
     def to_dict(self):
         data = {
             "system": self.system.identifier,

vulnerabilities/importers/postgresql.py

@@ -113,8 +113,9 @@ def to_advisories(data):
                 severities = []
                 if "support/security/CVE" in link and vector_link_tag:
                     parsed_link = urlparse.urlparse(vector_link_tag["href"])
-                    cvss3_vector = urlparse.parse_qs(parsed_link.query)["vector"]
+                    cvss3_vector = urlparse.parse_qs(parsed_link.query).get("vector", [""])[0]
                     cvss3_base_score = vector_link_tag.text
+                    cvss3_vector = "CVSS:3.0/" + cvss3_vector.removeprefix("CVSS:3.0/")
                     severity = VulnerabilitySeverity(
                         system=severity_systems.CVSSV3,
                         value=cvss3_base_score,