# cyclonedx.model.vulnerability

This set of classes represents the data that is possible about known Vulnerabilities.

Prior to CycloneDX schema version 1.4, vulnerabilities were possible in XML versions ONLY of the standard through a schema extension: https://cyclonedx.org/ext/vulnerability.

Since CycloneDX schema version 1.4, this has become part of the core schema.

Note

See the CycloneDX Schema extension definition https://cyclonedx.org/docs/1.7/xml/#type_vulnerabilitiesType

## Classes

`BomTargetVersionRange` | Class that represents either a version or version range and its affected status.
`BomTarget` | Class that represents referencing a Component or Service in a BOM.
`VulnerabilityAnalysis` | Class that models the analysis sub-element of the vulnerabilityType complex type.
`VulnerabilityAdvisory` | Class that models the advisoryType complex type.
`VulnerabilitySource` | Class that models the vulnerabilitySourceType complex type.
`VulnerabilityReference` | Class that models the nested reference within the vulnerabilityType complex type.
`VulnerabilityScoreSource` | Enum object that defines the permissible source types for a Vulnerability's score.
`VulnerabilitySeverity` | Class that defines the permissible severities for a Vulnerability.
`VulnerabilityRating` | Class that models the ratingType complex element CycloneDX core schema.
`VulnerabilityCredits` | Class that models the credits of vulnerabilityType complex type in the CycloneDX schema (version >= 1.4).
`Vulnerability` | Class that models the vulnerabilityType complex type in the CycloneDX schema (version >= 1.4).

## Module Contents

class cyclonedx.model.vulnerability.BomTargetVersionRange(*, version: str | None = None, range: str | None = None, status: cyclonedx.model.impact_analysis.ImpactAnalysisAffectedStatus | None = None)

  Class that represents either a version or version range and its affected status.

  version and version_range are mutually exclusive.

  Note

  See the CycloneDX schema: https://cyclonedx.org/docs/1.7/json/#tab-pane_vulnerabilities_items_affects_items_versions_items_oneOf_i0

  property version: str | None

    A single version of a component or service.

  property range: str | None

    A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst

    Note

    The VERSION-RANGE-SPEC from Package URL is not a formalised standard at the time of writing and this no validation of conformance with this draft standard is performed.

  property status: cyclonedx.model.impact_analysis.ImpactAnalysisAffectedStatus | None

    The vulnerability status for the version or range of versions.

class cyclonedx.model.vulnerability.BomTarget(*, ref: str, versions: collections.abc.Iterable[BomTargetVersionRange] | None = None)

  Class that represents referencing a Component or Service in a BOM.

  Aims to represent the sub-element target of the complex type vulnerabilityType.

  You can either create a cyclonedx.model.bom.Bom yourself programmatically, or generate a cyclonedx.model.bom.Bom from a cyclonedx.parser.BaseParser implementation.

  Note

  See the CycloneDX schema: https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_affects

  property ref: str

    Reference to a component or service by the objects bom-ref.

  property versions: SortedSet[BomTargetVersionRange]

    Zero or more individual versions or range of versions.

    Returns:

      Set of BomTargetVersionRange

class cyclonedx.model.vulnerability.VulnerabilityAnalysis(*, state: cyclonedx.model.impact_analysis.ImpactAnalysisState | None = None, justification: cyclonedx.model.impact_analysis.ImpactAnalysisJustification | None = None, responses: collections.abc.Iterable[cyclonedx.model.impact_analysis.ImpactAnalysisResponse] | None = None, detail: str | None = None, first_issued: datetime.datetime | None = None, last_updated: datetime.datetime | None = None)

  Class that models the analysis sub-element of the vulnerabilityType complex type.

  Note

  See the CycloneDX schema: https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_analysis

  property state: cyclonedx.model.impact_analysis.ImpactAnalysisState | None

    The declared current state of an occurrence of a vulnerability, after automated or manual analysis.

    Returns:

      ImpactAnalysisState if set else None

  property justification: cyclonedx.model.impact_analysis.ImpactAnalysisJustification | None

    The rationale of why the impact analysis state was asserted.

    Returns:

      ImpactAnalysisJustification if set else None

  property responses: SortedSet[ImpactAnalysisResponse]

    A list of responses to the vulnerability by the manufacturer, supplier, or project responsible for the affected component or service. More than one response is allowed. Responses are strongly encouraged for vulnerabilities where the analysis state is exploitable.

    Returns:

      Set of ImpactAnalysisResponse

  property detail: str | None

    A detailed description of the impact including methods used during assessment. If a vulnerability is not exploitable, this field should include specific details on why the component or service is not impacted by this vulnerability.

    Returns:

      str if set else None

  property first_issued: datetime.datetime | None
  property last_updated: datetime.datetime | None

class cyclonedx.model.vulnerability.VulnerabilityAdvisory(*, url: cyclonedx.model.XsUri, title: str | None = None)

  Class that models the advisoryType complex type.

  Note

  See the CycloneDX schema: https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_advisories

  property title: str | None

    The title of this advisory.

  property url: cyclonedx.model.XsUri

    The url of this advisory.

class cyclonedx.model.vulnerability.VulnerabilitySource(*, name: str | None = None, url: cyclonedx.model.XsUri | None = None)

  Class that models the vulnerabilitySourceType complex type.

  This type is used for multiple purposes in the CycloneDX schema.

  Note

  See the CycloneDX schema: https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_source

  property name: str | None

    Name of this Source.

  property url: cyclonedx.model.XsUri | None

    The url of this Source.

class cyclonedx.model.vulnerability.VulnerabilityReference(*, id: str, source: VulnerabilitySource)

  Class that models the nested reference within the vulnerabilityType complex type.

  Vulnerabilities may benefit from pointers to vulnerabilities that are the equivalent of the vulnerability specified. Often times, the same vulnerability may exist in multiple sources of vulnerability intelligence, but have different identifiers. These references provide a way to correlate vulnerabilities across multiple sources of vulnerability intelligence.

  Note

  See the CycloneDX schema: https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_references

  Note

  Properties `id` and `source` are mandatory.

  History: * In v1.4 JSON scheme, both properties were mandatory

  > https://github.com/CycloneDX/specification/blob/d570ffb8956d796585b9574e57598c42ee9de770/schema/bom-1.4.schema.json#L1455-L1474

  - In v1.4 XML schema, both properties were optional https://github.com/CycloneDX/specification/blob/d570ffb8956d796585b9574e57598c42ee9de770/schema/bom-1.4.xsd#L1788-L1797

  - In v1.5 XML schema, both were mandatory https://github.com/CycloneDX/specification/blob/d570ffb8956d796585b9574e57598c42ee9de770/schema/bom-1.5.xsd#L3364-L3374

  Decision: Since CycloneDXCoreWorkingGroup chose JSON schema as the dominant schema, the one that serves as first spec implementation, and since XML schema was “fixed” to work same as JSON schema, we’d consider it canon/spec that both properties were always mandatory.

  property id: str

    The identifier that uniquely identifies the vulnerability in the associated Source. For example: CVE-2021-39182.

  property source: VulnerabilitySource

    The source that published the vulnerability.

class cyclonedx.model.vulnerability.VulnerabilityScoreSource

  Bases: `str`, `enum.Enum`

  Enum object that defines the permissible source types for a Vulnerability’s score.

  Note

  See the CycloneDX Schema definition: https://cyclonedx.org/docs/1.7/xml/#type_scoreSourceType

  Note

  No explicit carry-over from the former schema extension:

    https://github.com/CycloneDX/specification/blob/master/schema/ext/vulnerability-1.0.xsd

  CVSS_V2 = 'CVSSv2'
  CVSS_V3 = 'CVSSv3'
  CVSS_V3_1 = 'CVSSv31'
  CVSS_V4 = 'CVSSv4'
  OWASP = 'OWASP'
  SSVC = 'SSVC'
  OTHER = 'other'
  static get_from_vector(vector: str) → VulnerabilityScoreSource

    Attempt to derive the correct SourceType from an attack vector.

    For example, often attack vector strings are prefixed with the scheme in question - such that __CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N__ would be the vector __AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N__ under the __CVSS 3__ scheme.

    Returns:

      Always returns an instance of VulnerabilityScoreSource. VulnerabilityScoreSource.OTHER is returned if the scheme is not obvious or known to us.

  get_localised_vector(vector: str) → str

    This method will remove any Source Scheme type from the supplied vector, returning just the vector.

    Note

    Currently supports CVSS 3.x, CVSS 2.x and OWASP schemes.

    Returns:

      The vector without any scheme prefix as a str.

  get_value_pre_1_4() → str

    Some of the enum values changed in 1.4 of the CycloneDX spec. This method allows us to backport some of the changes for pre-1.4.

    Returns:

      str

class cyclonedx.model.vulnerability.VulnerabilitySeverity

  Bases: `str`, `enum.Enum`

  Class that defines the permissible severities for a Vulnerability.

  Note

  See the CycloneDX schema: https://cyclonedx.org/docs/1.7/xml/#type_severityType

  NONE = 'none'
  INFO = 'info'
  LOW = 'low'
  MEDIUM = 'medium'
  HIGH = 'high'
  CRITICAL = 'critical'
  UNKNOWN = 'unknown'
  static get_from_cvss_scores(scores: tuple[float, Ellipsis] | float | None) → VulnerabilitySeverity

    Deprecated — Alias of `cyclonedx.contrib.vulnerability.cvss.vs_from_cvss_scores()`.

    Derives the Severity of a Vulnerability from it’s declared CVSS scores.

    Deprecated since version next: Use `cyclonedx.contrib.vulnerability.cvss.vs_from_cvss_scores()` instead.

class cyclonedx.model.vulnerability.VulnerabilityRating(*, source: VulnerabilitySource | None = None, score: decimal.Decimal | None = None, severity: VulnerabilitySeverity | None = None, method: VulnerabilityScoreSource | None = None, vector: str | None = None, justification: str | None = None)

  Class that models the ratingType complex element CycloneDX core schema.

  This class previously modelled the scoreType complexe type in the schema extension used prior to schema version 1.4 - see https://github.com/CycloneDX/specification/blob/master/schema/ext/vulnerability-1.0.xsd.

  Note

  See the CycloneDX Schema definition: https://cyclonedx.org/docs/1.7/xml/#type_ratingType

  Warning

  As part of implementing support for CycloneDX schema version 1.4, the three score types defined in the schema extension used prior to 1.4 have been deprecated. The deprecated score_base should loosely be equivalent to the new score in 1.4 schema. Both score_impact and score_exploitability are deprecated and removed as they are redundant if you have the vector (the vector allows you to calculate the scores).

  property source: VulnerabilitySource | None

    The source that published the vulnerability.

  property score: decimal.Decimal | None

    The numerical score of the rating.

  property severity: VulnerabilitySeverity | None

    The textual representation of the severity that corresponds to the numerical score of the rating.

  property method: VulnerabilityScoreSource | None

    The risk scoring methodology/standard used.

  property vector: str | None

    The textual representation of the metric values used to score the vulnerability - also known as the vector.

  property justification: str | None

    An optional reason for rating the vulnerability as it was.

class cyclonedx.model.vulnerability.VulnerabilityCredits(*, organizations: collections.abc.Iterable[cyclonedx.model.contact.OrganizationalEntity] | None = None, individuals: collections.abc.Iterable[cyclonedx.model.contact.OrganizationalContact] | None = None)

  Class that models the credits of vulnerabilityType complex type in the CycloneDX schema (version >= 1.4).

  This class also provides data support for schema versions < 1.4 where Vulnerabilites were possible through a schema extension (in XML only).

  Note

  See the CycloneDX schema: https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_credits

  property organizations: SortedSet[OrganizationalEntity]

    The organizations credited with vulnerability discovery.

    Returns:

      Set of OrganizationalEntity

  property individuals: SortedSet[OrganizationalContact]

    The individuals, not associated with organizations, that are credited with vulnerability discovery.

    Returns:

      Set of OrganizationalContact

class cyclonedx.model.vulnerability.Vulnerability(*, bom_ref: str | cyclonedx.model.bom_ref.BomRef | None = None, id: str | None = None, source: VulnerabilitySource | None = None, references: collections.abc.Iterable[VulnerabilityReference] | None = None, ratings: collections.abc.Iterable[VulnerabilityRating] | None = None, cwes: collections.abc.Iterable[int] | None = None, description: str | None = None, detail: str | None = None, recommendation: str | None = None, workaround: str | None = None, advisories: collections.abc.Iterable[VulnerabilityAdvisory] | None = None, created: datetime.datetime | None = None, published: datetime.datetime | None = None, updated: datetime.datetime | None = None, credits: VulnerabilityCredits | None = None, tools: collections.abc.Iterable[cyclonedx.model.tool.Tool] | cyclonedx.model.tool.ToolRepository | None = None, analysis: VulnerabilityAnalysis | None = None, affects: collections.abc.Iterable[BomTarget] | None = None, properties: collections.abc.Iterable[cyclonedx.model.Property] | None = None)

  Class that models the vulnerabilityType complex type in the CycloneDX schema (version >= 1.4).

  This class also provides data support for schema versions < 1.4 where Vulnerabilites were possible through a schema extension (in XML only).

  Note

  See the CycloneDX schema: https://cyclonedx.org/docs/1.7/xml/#type_vulnerabilityType

  property id: str | None

    The identifier that uniquely identifies the vulnerability. For example: CVE-2021-39182.

    Returns:

      str if set else None

  property source: VulnerabilitySource | None

    The source that published the vulnerability.

    Returns:

      VulnerabilitySource if set else None

  property references: SortedSet[VulnerabilityReference]

    Zero or more pointers to vulnerabilities that are the equivalent of the vulnerability specified. Often times, the same vulnerability may exist in multiple sources of vulnerability intelligence, but have different identifiers. References provides a way to correlate vulnerabilities across multiple sources of vulnerability intelligence.

    Returns:

      Set of VulnerabilityReference

  property ratings: SortedSet[VulnerabilityRating]

    List of vulnerability ratings.

    Returns:

      Set of VulnerabilityRating

  property cwes: SortedSet[int]

    A list of CWE (Common Weakness Enumeration) identifiers.

    Note

    See https://cwe.mitre.org/

    Returns:

      Set of int

  property description: str | None

    A description of the vulnerability as provided by the source.

    Returns:

      str if set else None

  property detail: str | None

    If available, an in-depth description of the vulnerability as provided by the source organization. Details often include examples, proof-of-concepts, and other information useful in understanding root cause.

    Returns:

      str if set else None

  property recommendation: str | None

    Recommendations of how the vulnerability can be remediated or mitigated.

    Returns:

      str if set else None

  property workaround: str | None

    A bypass, usually temporary, of the vulnerability that reduces its likelihood and/or impact. Workarounds often involve changes to configuration or deployments.

    Returns:

      str if set else None

  property advisories: SortedSet[VulnerabilityAdvisory]

    Advisories relating to the Vulnerability.

    Returns:

      Set of VulnerabilityAdvisory

  property created: datetime.datetime | None

    The date and time (timestamp) when the vulnerability record was created in the vulnerability database.

    Returns:

      datetime if set else None

  property published: datetime.datetime | None

    The date and time (timestamp) when the vulnerability record was first published.

    Returns:

      datetime if set else None

  property updated: datetime.datetime | None

    The date and time (timestamp) when the vulnerability record was last updated.

    Returns:

      datetime if set else None

  property credits: VulnerabilityCredits | None

    Individuals or organizations credited with the discovery of the vulnerability.

    Returns:

      VulnerabilityCredits if set else None

  property tools: cyclonedx.model.tool.ToolRepository

    Tools used to create this BOM.

    Returns:

      `ToolRepository` object.

  property analysis: VulnerabilityAnalysis | None

    Analysis of the Vulnerability in your context.

    Returns:

      VulnerabilityAnalysis if set else None

  property affects: SortedSet[BomTarget]

    The components or services that are affected by the vulnerability.

    Returns:

      Set of BomTarget

  property properties: SortedSet[Property]

    Provides the ability to document properties in a key/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions.

    Return:

      Set of Property

  property bom_ref: cyclonedx.model.bom_ref.BomRef

    Get the unique reference for this Vulnerability in this BOM.

    Returns:

      BomRef