Improper Input Validation in CVSS v3 parsing

[Lucas Tesson]

While fuzzing this implementation, I discovered that some invalid inputs did not raise errors.
This could be categorized as CWE-20.

For instance, the following Go code does not produce any error.

package main

import (
	"fmt"

	"github.com/goark/go-cvss/v3/metric"
)

func main() {
	rawVec := "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L/RC:"
	vec, err := metric.NewEnvironmental().Decode(rawVec)

	fmt.Printf("vec: %v\n", vec)
	fmt.Printf("err: %v\n", err)
}

produces ->

vec: &{0xc0000bc000 X X X X X X X X X X X}
err: <nil>

You can check this input is invalid, using the official first.org calculator which does not give scores despite base metrics being all defined, or by looking at the specification Table 15 which shows the RC (ReportConfidence) metric can't be empty.

[Spiegel]

Released v1.3.1