-
Notifications
You must be signed in to change notification settings - Fork 2
Include vulnerabilities in trust score calculation #422
Comments
@vpetersson Please specify whether we need Additions 1 or 2 (or both). And how should they affect trust score.
|
I've just found out that debsecan database (and security tracker) doesn't even match their own bug tracker. An example: Hence I think we should use other databases to assess vulnerability priority. |
@a-martynovich what do you think about something like this? For each vulnerability, we deduct:
(max 40 points) |
@vpetersson I would change this a little bit. In case if a vuln in remotely exploitable I would double its points. |
Sure. That seems sensible.
Just count them as a low until we know. |
This will make more sense after completion of #421.
Count the number of unique vulnerabilities which have fixes (?). If their number is more than some
Vmax
the trust score element should be zero. If their number is zero the trust score element should be 1.Addition 1: split the vulnerabilities by priority, count them separately. In trust score their numbers should have different weights.
Addition 2: vulnerabilities which are not remotely exploitable should also have different weights.
The text was updated successfully, but these errors were encountered: