vulnerability: Add CVSS Vectors to JSON output.

[simar7]

Now Trivy will display the CVSS Vectors presented by various
vendors as part of the JSON output. This can be seen as follows:

      {
        "VulnerabilityID": "CVE-2019-9923",
        "PkgName": "tar",
        "InstalledVersion": "1.30+dfsg-6",
        "Layer": {
          "Digest": "sha256:90fe46dd819953eb995f9cc9c326130abe9dd0b3993a998e12c01d0218a0b831",
          "DiffID": "sha256:e40d297cf5f89a9822af4c2f63caa2f2085d5aa188137506918e603774b083cb"
        },
        "SeveritySource": "debian",
        "Title": "tar: null-pointer dereference in pax_decode_header in sparse.c",
        "Description": "pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.",
        "Severity": "LOW",
        "VendorVectors": {
          "nvd": {
            "v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "redhat": {
            "v3": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
          }
        },
        "References": [
          "http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html",
          "http://savannah.gnu.org/bugs/?55369",
          "https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241"
        ]
      },

Signed-off-by: Simarpreet Singh [email protected]

[knqyf263]

LGTM! Please note that we have to update trivy-db by go get -u 😉

[knqyf263]

I don't look into the error deeply yet, but it looks like testcontainers is failing to run a container.

[mozillazg]

Thanks for your work! Is there any reason why the VendorVectors doesn't include score info? And how can i get the vendor score base on vector of v2 or v3 via fast/easy way? Thanks!

[simar7]

Thanks for your work! Is there any reason why the VendorVectors doesn't include score info? And how can i get the vendor score base on vector of v2 or v3 via fast/easy way? Thanks!

@mozillazg you can use it like the following

$ trivy image --format=json alpine=3.10.4
[...output snipped...]
        "VendorVectors": {
          "nvd": {
            "v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "redhat": {
            "v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          }
        },
[...output snipped...]

[mozillazg]

@simar7 Sorry for my bad english 😂 ，I mean why the result of VendorVectors not include score result like this (is suggested from #92 (comment) and it's necessary so that the user don't have to calculate it by himself):

[...output snipped...]
        "VendorVectors": {
          "nvd": {
            "v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "v2Score": 7.5,   // score result
            "v3Score": 9.8    // score result
          },
        },
[...output snipped...]

or

[...output snipped...]
        "VendorVectors": {
          "nvd": {
            "v2": {
               "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
               "score": 7.5   // score result
            }
            "v3": {
               "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               "score": 9.8  // score result
            }
          },
        },
[...output snipped...]

[simar7]

@simar7 Sorry for my bad english 😂 ，I mean why the result of VendorVectors not include score result like this (is suggested from #92 (comment) and it's necessary so that the user don't have to calculate it by himself):

[...output snipped...]
        "VendorVectors": {
          "nvd": {
            "v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "v2Score": 7.5,   // score result
            "v3Score": 9.8    // score result
          },
        },
[...output snipped...]

or

[...output snipped...]
        "VendorVectors": {
          "nvd": {
            "v2": {
               "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
               "score": 7.5   // score result
            }
            "v3": {
               "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               "score": 9.8  // score result
            }
          },
        },
[...output snipped...]

Sorry I see your point now. Yes we're adding it here aquasecurity/trivy-db#48