active_edit --cvss argument does not work

Bug #2058614 reported by Steve Beattie
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ubuntu CVE Tracker
Fix Released
Undecided
Unassigned

Bug Description

Attempting to add a cvss score via active_edit does not work:

$ ./scripts/active_edit -c CVE-2024-NNN1 -p bash --cvss "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" --priority medium -d "this is a description"
Traceback (most recent call last):
  File "/home/steve/git/ubuntu-cve-tracker/./scripts/active_edit", line 293, in <module>
    create_or_update_cve(cve, pkgs, priority=options.priority, bug_urls=options.bug_urls, ref_urls=options.ref_urls, public_date=optio
ns.public_date, desc=options.description, cvss=options.cvss, embargoed=options.embargoed, breakfix=options.breakfix)
  File "/home/steve/git/ubuntu-cve-tracker/./scripts/active_edit", line 255, in create_or_update_cve
    src, cvss = entry
    ^^^^^^^^^
ValueError: not enough values to unpack (expected 2, got 1)

This is because there is supposed to be an origin for the cvss score, but there is no way to provide on the command line that I can see, whatever is passed in is blindly passed to create_or_update_cve() as a list, but the list is expected to contain tuples of (src, cvss).

[I hit this trying to make sure the merge proposal https://code.launchpad.net/~emitorino/ubuntu-cve-tracker/+git/ubuntu-cve-tracker/+merge/459935 wasn't going to break anything but couldn't test the case when we're adding a cve that has a cvss score that is different from our prioritization.)

Steve Beattie (sbeattie)
description: updated
Revision history for this message
Alex Murray (alexmurray) wrote :
Alex Murray (alexmurray)
Changed in ubuntu-cve-tracker:
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.