Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan cara Artifact Analysis mengevaluasi kerentanan dan
menetapkan tingkat keparahan.
Artifact Analysis menilai tingkat keparahan kerentanan menggunakan tingkat berikut:
Kritis
Tinggi
Sedang
Rendah
Tingkat keparahan ini adalah label kualitatif yang mencerminkan faktor-faktor seperti
eksploitasi, cakupan, dampak, dan kematangan kerentanan. Misalnya,
jika kerentanan memungkinkan pengguna jarak jauh mengakses sistem dan menjalankan kode
arbitrer tanpa autentikasi atau interaksi pengguna, kerentanan tersebut
akan diklasifikasikan sebagai Critical.
Ada dua jenis keparahan tambahan yang terkait dengan setiap kerentanan:
Keparahan efektif - Bergantung pada jenis kerentanan:
Paket OS - Tingkat keparahan yang ditetapkan oleh pengelola
distribusi Linux. Jika tingkat keparahan ini tidak tersedia,
Analisis Artefak akan menggunakan nilai keparahan dari penyedia catatan,
(NVD). Jika rating CVSS v2 NVD
tidak tersedia, Artifact Analysis akan menggunakan rating CVSS v3 dari NVD.
Paket bahasa - Tingkat keparahan yang ditetapkan oleh
GitHub Advisory Database, dengan sedikit perbedaan:
Sedang dilaporkan sebagai Sedang.
Skor CVSS - Skor Sistem Penskoran Kerentanan Umum dan tingkat keparahan terkait, dengan dua versi penskoran:
CVSS 2.0 - Tersedia saat menggunakan API, Google Cloud CLI, dan GUI.
CVSS 3.1 - Tersedia saat menggunakan API dan gcloud CLI.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-02 UTC."],[[["\u003cp\u003eArtifact Analysis evaluates and assigns severity levels to vulnerabilities based on factors like exploitability and impact.\u003c/p\u003e\n"],["\u003cp\u003eSeverity levels include Critical, High, Medium, and Low, providing a qualitative assessment of each vulnerability.\u003c/p\u003e\n"],["\u003cp\u003eEffective severity is determined by either the Linux distribution maintainer for OS packages or the GitHub Advisory Database for language packages, and it differs slightly from the severity levels.\u003c/p\u003e\n"],["\u003cp\u003eThe CVSS score, available in versions 2.0 and 3.1, provides a quantitative measure of vulnerability severity, complementing the qualitative severity levels.\u003c/p\u003e\n"]]],[],null,["# Severity levels in Artifact Analysis\n\nThis document describes how Artifact Analysis evaluates vulnerabilities and\nassigns severity levels.\n\nArtifact Analysis rates vulnerability severity using the following levels:\n\n- Critical\n- High\n- Medium\n- Low\n\nThese severity levels are qualitative labels that reflect factors such as\nexploitability, scope, impact, and maturity of the vulnerability. For example,\nif a vulnerability enables a remote user to access a system and run arbitrary\ncode without authentication or user interaction, that vulnerability\nwould be classified as `Critical`.\n\nTwo additional types of severity are associated with each vulnerability:\n\n- Effective severity - Depending on the vulnerability type:\n\n - OS packages - The severity level assigned by the Linux distribution maintainer. If these severity levels are unavailable, Artifact Analysis uses the severity value from the note provider, [(NVD)](https://nvd.nist.gov/vuln-metrics). If NVD's CVSS v2 rating is unavailable, Artifact Analysis uses the CVSS v3 rating from NVD.\n - Language packages - The [severity level](https://docs.github.com/en/graphql/reference/enums#securityadvisoryseverity) assigned by the GitHub Advisory Database, with a slight difference: *Moderate* is reported as *Medium*.\n- [CVSS score](https://www.first.org/cvss/v3.1/user-guide#Scoring-Guide) - The Common\n Vulnerability Scoring System score and associated severity level, with two\n scoring versions:\n\n - [CVSS 2.0](https://www.first.org/cvss/v2/guide) - Available when using the API, the Google Cloud CLI, and the GUI.\n - [CVSS 3.1](https://first.org/cvss/v3.1/user-guide) - Available when using the API and the gcloud CLI.\n\nWhat's next\n-----------\n\n- [Investigate vulnerabilities](/artifact-analysis/docs/investigate-vulnerabilities).\n- [Gate builds in your Cloud Build pipeline](/artifact-analysis/docs/ods-cloudbuild) based on vulnerability severity."]]
