CVSS score missing on ubuntu_api key

[Aman1994]

When i build the latest image from HEAD(45714b6) i can see now it giving result from multiple sources . Sample output

{
  "euvd": [
    {
      "cveID": "CVE-2016-2568",
      "cvss2Score": 0,
      "cvss2Severity": "",
      "cvss3Score": 0,
      "cvss3Severity": ""
    }
  ],
  "jvn": [
    {
      "cveID": "CVE-2016-2568",
      "cvss2Score": 0,
      "cvss2Severity": "",
      "cvss3Score": 0,
      "cvss3Severity": ""
    }
  ],
  "mitre": [
    {
      "cveID": "CVE-2016-2568",
      "cvss2Score": 0,
      "cvss2Severity": "",
      "cvss3Score": 0,
      "cvss3Severity": ""
    },
    {
      "cveID": "CVE-2016-2568",
      "cvss2Score": 0,
      "cvss2Severity": "",
      "cvss3Score": 0,
      "cvss3Severity": ""
    }
  ],
  "nvd": [
    {
      "cveID": "CVE-2016-2568",
      "cvss2Score": 4.4,
      "cvss2Severity": "MEDIUM",
      "cvss3Score": 7.8,
      "cvss3Severity": "HIGH"
    }
  ],
  "redhat_api": [
    {
      "cveID": "CVE-2016-2568",
      "cvss2Score": 5.1,
      "cvss2Severity": "Moderate",
      "cvss3Score": 6.1,
      "cvss3Severity": "Moderate"
    }
  ],
  "ubuntu_api": [
    {
      "cveID": "CVE-2016-2568",
      "cvss2Score": 0,
      "cvss2Severity": "low",
      "cvss3Score": 0,
      "cvss3Severity": "low"
    }
  ],
  "vulncheck": [
    {
      "cveID": "CVE-2016-2568",
      "cvss2Score": 4.4,
      "cvss2Severity": "MEDIUM",
      "cvss3Score": 7.8,
      "cvss3Severity": "HIGH"
    }
  ]
}

Earlier on the latest release 0.39.3 there were only two redhat_api and ubuntu_api

My doubt here is why under ubuntu_api score is coming as 0 but when i open the CVE in the browser https://ubuntu.com/security/CVE-2016-2568 it does shows the score which matches the one in NVD.

Why can't we just add the same NVD score in the ubuntu_api key block . Is that by design or something it will be fixed later.

Sponsored by: https://obmondo.com/

[MaineK00n]

Thanks for the detailed report!

This is by design rather than a bug.

The CVSS score shown on https://ubuntu.com/security/CVE-2016-2568 is not Ubuntu's own assessment — it is simply the NVD score that Ubuntu re-publishes. You can see this in the upstream data source, ubuntu-cve-tracker:

https://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2016-2568

There the CVSS entry is explicitly tagged with its source (nvd), i.e. Ubuntu is just carrying over the NVD score, not scoring the vulnerability itself.

So if we copied that value into the ubuntu_api block, we would have two problems:

1. Duplication — it would be the exact same data we already report under the nvd key (4.4 / 7.8, as in your output).
2. Misattribution — it would look as though Ubuntu analyzed the vulnerability and assigned that CVSS score, which is not the case. Users comparing per-source scores (e.g. nvd vs redhat_api vs ubuntu_api) would be misled into thinking Ubuntu independently agreed with NVD's severity.

What Ubuntu does assign is its own priority, and that is what you see reflected as "cvss2Severity": "low" / "cvss3Severity": "low" in the ubuntu_api block — the score stays 0 because Ubuntu does not publish a score of its own.

Regarding the increase in sources compared with 0.39.3: that is expected. The newer detection path reports each source separately so that you can see exactly who said what, instead of silently merging values from different vendors.