Re:GitHub’s database of security advisories is now open source
by greysteil on Sunday February 27, 2022 @08:57AM
(#30488462)
Oh good question. I can't answer this one as authoritatively as I'd like - I'll double check with the team next week.
One thing to note is that the full CVSS 3.1 string is included in the database as assessed by NIST. The severity displayed by GitHub is stored as a "database specific" field, so it looks like we're trying to be explicit about the existence of multiple perspectives on severity (one of which is our own), but that we could do more to make that clear.
One thing to note is that the full CVSS 3.1 string is included in the database as assessed by NIST. The severity displayed by GitHub is stored as a "database specific" field, so it looks like we're trying to be explicit about the existence of multiple perspectives on severity (one of which is our own), but that we could do more to make that clear.
https://github.com/github/advisory-database/blob/main/adviso...