CVSSv3 Support?

Mattys · March 22, 2019, 3:55pm

Is there any way to use the CVSSv3 scoring system instead of CVSSv2?

Currently using OpenVAS 9.0.0-2739 from the Atomic repo.
If not will it be included in GVM-10?

cfi · April 9, 2019, 6:54pm

Those tweets might be relevant for your question:

It’s on our list
https://twitter.com/BjoernRicks/status/1115309022805155840

It’s not scheduled yet. But it seems it gets more import in the next months.
https://twitter.com/BjoernRicks/status/1115497842293002240

CVSSv3 has some compatibility issues when involved in larger setups where auditing and correlations are vital. We are working on those aspects, as we would like to be backward compatible as much as possible. That’s why we don’t have an ETA yet.
https://twitter.com/GreenboneEN/status/1115538877811515392

aylatalo · September 6, 2019, 1:45pm

Anything new on the topic?

tatooin · October 15, 2020, 12:47pm

Same question. Any update on this ?

Thanks

bricks · October 15, 2020, 2:23pm

We are currently working on support for CVSSv3 and it will be part of GOS and GVM 21.04. That doesn’t mean all VTs will use CVSSv3 but it will be possible technically and the whole GVM stack will support different sources/kinds of severity scores.