Improve vulnerability severity or scoring storage design

[kartiksibal]

We presently have just CVSS as a vulnerability severity indicator. Some datasets classify vulnerability as a textual indicator, High, Low, etc.

We can add:

vulnerability_score=models.TextField(max_length=50, help_text="Severity of the vulnerability")

This will ensure that we can save both Textual & Non-CVSS severity indicators, that any dataset provides.

[pombredanne]

@kartiksibal could you document here some of the scoring or severity information available elsewhere? such that we have a reasonable sampling of the different ways that exist?

[pombredanne]

@kartiksibal you wrote:

Should we discuss a bit about this
Or should I leave CVSS entirely for the moment,
since neither Debian nor Ubuntu provides CVSS

Leave it out for now

[kartiksibal]

@pombredanne Noted. 👍

[sbs2001]

We can also interconvert between cvss v2,cvss v3,cvss v1 . We need to do this since not all advisories use same cvss version. https://security.stackexchange.com/questions/127335/how-to-convert-risk-scores-cvssv1-cvssv2-cvssv3-owasp-risk-severity shows how to do this .