fix: add validation for cvss severity scores

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

vulnerabilities/importer.py

@@ -33,6 +33,9 @@
 
 from vulnerabilities import severity_systems
 from vulnerabilities.oval_parser import OvalParser
+from vulnerabilities.severity_systems import CVSSV3
+from vulnerabilities.severity_systems import CVSSV4
+from vulnerabilities.severity_systems import CVSSV31
 from vulnerabilities.severity_systems import SCORING_SYSTEMS
 from vulnerabilities.severity_systems import ScoringSystem
 from vulnerabilities.utils import classproperty
@@ -67,6 +70,19 @@ def __post_init__(self):
         if not isinstance(self.value, str):
             self.value = str(self.value)
 
+        if self.scoring_elements and self.system in (CVSSV3, CVSSV31, CVSSV4):
+            vector_value = self.value
+            try:
+                vector_value = float(vector_value)
+            except (TypeError, ValueError):
+                vector_value = None
+
+            cvss_score = self.system.compute(self.scoring_elements)
+            if vector_value and float(cvss_score) != vector_value:
+                raise ValueError(
+                    f"CVSS vector and base score do not match: {self.scoring_elements} != {self.value}"
+                )
+
     def to_dict(self):
         data = {
             "system": self.system.identifier,

vulnerabilities/importers/postgresql.py

@@ -113,8 +113,9 @@ def to_advisories(data):
                 severities = []
                 if "support/security/CVE" in link and vector_link_tag:
                     parsed_link = urlparse.urlparse(vector_link_tag["href"])
-                    cvss3_vector = urlparse.parse_qs(parsed_link.query)["vector"]
+                    cvss3_vector = urlparse.parse_qs(parsed_link.query).get("vector", [""])[0]
                     cvss3_base_score = vector_link_tag.text
+                    cvss3_vector = "CVSS:3.0/" + cvss3_vector.removeprefix("CVSS:3.0/")
                     severity = VulnerabilitySeverity(
                         system=severity_systems.CVSSV3,
                         value=cvss3_base_score,