run2-cvss-score-extraction

name	run2_cvss-score-extraction
description	Extract CVSS v3 scores from Trivy vulnerability JSON with source priority (NVD > GHSA > RedHat) and fallback to N/A.

CVSS Score Extraction (Round 2)

Priority Order

NVD V3Score → GHSA V3Score → RedHat V3Score → N/A

Do NOT fall back to V2Score — severity labels (HIGH/CRITICAL) come from Trivy's own assessment and are already correct; we only need the numeric score for reporting.

Canonical Implementation

def get_cvss_score(vuln):
    """
    Extract CVSS v3 score with source priority: NVD > GHSA > RedHat.
    Returns float score or string 'N/A'.
    """
    cvss = vuln.get('CVSS', {})
    if not isinstance(cvss, dict):
        return 'N/A'
    for source in ['nvd', 'ghsa', 'redhat']:
        entry = cvss.get(source, {})
        if isinstance(entry, dict):
            score = entry.get('V3Score')
            if score is not None and isinstance(score, (int, float)):
                return score
    return 'N/A'

Real-World Examples from This Task

CVE	NVD	GHSA	RedHat	Result
CVE-2024-29415 (ip)	-	8.1	9.8	8.1 (GHSA wins, NVD absent)
CVE-2022-25883 (semver)	7.5	7.5	7.5	7.5 (NVD wins)
CVE-2026-23745 (tar)	-	-	8.2	8.2 (RedHat only)

Notes

• Source keys in Trivy JSON are lowercase: nvd, ghsa, redhat
• Only V3Score field is relevant (not V3Vector)
• When NVD is absent, GHSA is usually the next best source