From b1319d1909dfd992cc5e1bca563c586b467af0a8 Mon Sep 17 00:00:00 2001 From: Vijay Sarvepalli Date: Thu, 31 Oct 2024 16:05:06 -0400 Subject: [PATCH] Updates from mkdocs latest version for space issues --- .../decision_points/automatable_2_0_0.md | 24 +++++++-------- .../decision_points/exploitation_1_0_0.md | 26 ++++++++-------- .../decision_points/exploitation_1_1_0.md | 26 ++++++++-------- .../decision_points/human_impact_2_0_0.md | 28 ++++++++--------- .../decision_points/human_impact_2_0_1.md | 28 ++++++++--------- .../mission_and_well-being_impact_1_0_0.md | 26 ++++++++-------- .../decision_points/mission_impact_1_0_0.md | 30 +++++++++---------- .../decision_points/mission_impact_2_0_0.md | 28 ++++++++--------- .../public_safety_impact_2_0_0.md | 24 +++++++-------- .../public_safety_impact_2_0_1.md | 24 +++++++-------- .../public_value_added_1_0_0.md | 26 ++++++++-------- .../public_well-being_impact_1_0_0.md | 26 ++++++++-------- .../report_credibility_1_0_0.md | 24 +++++++-------- .../decision_points/report_public_1_0_0.md | 24 +++++++-------- .../decision_points/safety_impact_1_0_0.md | 30 +++++++++---------- .../decision_points/safety_impact_2_0_0.md | 28 ++++++++--------- .../supplier_cardinality_1_0_0.md | 24 +++++++-------- .../supplier_contacted_1_0_0.md | 24 +++++++-------- .../supplier_engagement_1_0_0.md | 24 +++++++-------- .../supplier_involvement_1_0_0.md | 26 ++++++++-------- .../decision_points/system_exposure_1_0_0.md | 26 ++++++++-------- .../decision_points/system_exposure_1_0_1.md | 26 ++++++++-------- .../decision_points/technical_impact_1_0_0.md | 24 +++++++-------- .../decision_points/utility_1_0_0.md | 26 ++++++++-------- .../decision_points/utility_1_0_1.md | 26 ++++++++-------- .../decision_points/value_density_1_0_0.md | 24 +++++++-------- .../decision_points/virulence_1_0_0.md | 24 +++++++-------- src/ssvc/doctools.py | 20 ++++++------- 28 files changed, 358 insertions(+), 358 deletions(-) diff --git a/docs/_generated/decision_points/automatable_2_0_0.md b/docs/_generated/decision_points/automatable_2_0_0.md index 96befcd5..20084953 100644 --- a/docs/_generated/decision_points/automatable_2_0_0.md +++ b/docs/_generated/decision_points/automatable_2_0_0.md @@ -1,17 +1,17 @@ !!! note "Automatable v2.0.0" - === "Text" - - Can an attacker reliably automate creating exploitation events for this vulnerability? +=== "Text" + + Can an attacker reliably automate creating exploitation events for this vulnerability? - | Value | Definition | - |:-----|:-----------| - | No | Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation. | - | Yes | Attackers can reliably automate steps 1-4 of the kill chain. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | No | Attackers cannot reliably automate steps 1-4 of the kill chain for this vulnerability. These steps are (1) reconnaissance, (2) weaponization, (3) delivery, and (4) exploitation. | + | Yes | Attackers can reliably automate steps 1-4 of the kill chain. | - ```json - {% include "../../../data/json/decision_points/automatable_2_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/automatable_2_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/exploitation_1_0_0.md b/docs/_generated/decision_points/exploitation_1_0_0.md index 1b07d383..a4ab75dd 100644 --- a/docs/_generated/decision_points/exploitation_1_0_0.md +++ b/docs/_generated/decision_points/exploitation_1_0_0.md @@ -1,18 +1,18 @@ !!! note "Exploitation v1.0.0" - === "Text" - - The present state of exploitation of the vulnerability. +=== "Text" + + The present state of exploitation of the vulnerability. - | Value | Definition | - |:-----|:-----------| - | None | There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability. | - | PoC | One of the following cases is true: (1) private evidence of exploitation is attested but not shared; (2) widespread hearsay attests to exploitation; (3) typical public PoC in places such as Metasploit or ExploitDB; or (4) the vulnerability has a well-known method of exploitation. | - | Active | Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | None | There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability. | + | PoC | One of the following cases is true: (1) private evidence of exploitation is attested but not shared; (2) widespread hearsay attests to exploitation; (3) typical public PoC in places such as Metasploit or ExploitDB; or (4) the vulnerability has a well-known method of exploitation. | + | Active | Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting. | - ```json - {% include "../../../data/json/decision_points/exploitation_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/exploitation_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/exploitation_1_1_0.md b/docs/_generated/decision_points/exploitation_1_1_0.md index f45a41a5..910b8080 100644 --- a/docs/_generated/decision_points/exploitation_1_1_0.md +++ b/docs/_generated/decision_points/exploitation_1_1_0.md @@ -1,18 +1,18 @@ !!! note "Exploitation v1.1.0" - === "Text" - - The present state of exploitation of the vulnerability. +=== "Text" + + The present state of exploitation of the vulnerability. - | Value | Definition | - |:-----|:-----------| - | None | There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability. | - | Public PoC | One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation. | - | Active | Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | None | There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability. | + | Public PoC | One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation. | + | Active | Shared, observable, reliable evidence that the exploit is being used in the wild by real attackers; there is credible public reporting. | - ```json - {% include "../../../data/json/decision_points/exploitation_1_1_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/exploitation_1_1_0.json" %} + ``` diff --git a/docs/_generated/decision_points/human_impact_2_0_0.md b/docs/_generated/decision_points/human_impact_2_0_0.md index 7331fb39..15ff4c86 100644 --- a/docs/_generated/decision_points/human_impact_2_0_0.md +++ b/docs/_generated/decision_points/human_impact_2_0_0.md @@ -1,19 +1,19 @@ !!! note "Human Impact v2.0.0" - === "Text" - - Human Impact is a combination of Safety and Mission impacts. +=== "Text" + + Human Impact is a combination of Safety and Mission impacts. - | Value | Definition | - |:-----|:-----------| - | Low | Safety Impact:(None OR Minor) AND Mission Impact:(None OR Degraded OR Crippled) | - | Medium | (Safety Impact:(None OR Minor) AND Mission Impact:MEF Failure) OR (Safety Impact:Major AND Mission Impact:(None OR Degraded OR Crippled)) | - | High | (Safety Impact:Hazardous AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Major AND Mission Impact:MEF Failure) | - | Very High | Safety Impact:Catastrophic OR Mission Impact:Mission Failure | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Low | Safety Impact:(None OR Minor) AND Mission Impact:(None OR Degraded OR Crippled) | + | Medium | (Safety Impact:(None OR Minor) AND Mission Impact:MEF Failure) OR (Safety Impact:Major AND Mission Impact:(None OR Degraded OR Crippled)) | + | High | (Safety Impact:Hazardous AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Major AND Mission Impact:MEF Failure) | + | Very High | Safety Impact:Catastrophic OR Mission Impact:Mission Failure | - ```json - {% include "../../../data/json/decision_points/human_impact_2_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/human_impact_2_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/human_impact_2_0_1.md b/docs/_generated/decision_points/human_impact_2_0_1.md index d5bf8ac8..122c1d7c 100644 --- a/docs/_generated/decision_points/human_impact_2_0_1.md +++ b/docs/_generated/decision_points/human_impact_2_0_1.md @@ -1,19 +1,19 @@ !!! note "Human Impact v2.0.1" - === "Text" - - Human Impact is a combination of Safety and Mission impacts. +=== "Text" + + Human Impact is a combination of Safety and Mission impacts. - | Value | Definition | - |:-----|:-----------| - | Low | Safety Impact:(Negligible) AND Mission Impact:(None OR Degraded OR Crippled) | - | Medium | (Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(None OR Degraded OR Crippled)) | - | High | (Safety Impact:Critical AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure) | - | Very High | Safety Impact:Catastrophic OR Mission Impact:Mission Failure | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Low | Safety Impact:(Negligible) AND Mission Impact:(None OR Degraded OR Crippled) | + | Medium | (Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(None OR Degraded OR Crippled)) | + | High | (Safety Impact:Critical AND Mission Impact:(None OR Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure) | + | Very High | Safety Impact:Catastrophic OR Mission Impact:Mission Failure | - ```json - {% include "../../../data/json/decision_points/human_impact_2_0_1.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/human_impact_2_0_1.json" %} + ``` diff --git a/docs/_generated/decision_points/mission_and_well-being_impact_1_0_0.md b/docs/_generated/decision_points/mission_and_well-being_impact_1_0_0.md index bfc26462..7a8affcd 100644 --- a/docs/_generated/decision_points/mission_and_well-being_impact_1_0_0.md +++ b/docs/_generated/decision_points/mission_and_well-being_impact_1_0_0.md @@ -1,18 +1,18 @@ !!! note "Mission and Well-Being Impact v1.0.0" - === "Text" - - Mission and Well-Being Impact is a combination of Mission Prevalence and Public Well-Being Impact. +=== "Text" + + Mission and Well-Being Impact is a combination of Mission Prevalence and Public Well-Being Impact. - | Value | Definition | - |:-----|:-----------| - | Low | Mission Prevalence:Minimal AND Public Well-Being Impact:Minimal | - | Medium | Mission Prevalence:Support AND Public Well-Being Impact:(Minimal OR Material) | - | High | Mission Prevalence:Essential OR Public Well-Being Impact:(Irreversible) | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Low | Mission Prevalence:Minimal AND Public Well-Being Impact:Minimal | + | Medium | Mission Prevalence:Support AND Public Well-Being Impact:(Minimal OR Material) | + | High | Mission Prevalence:Essential OR Public Well-Being Impact:(Irreversible) | - ```json - {% include "../../../data/json/decision_points/mission_and_well-being_impact_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/mission_and_well-being_impact_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/mission_impact_1_0_0.md b/docs/_generated/decision_points/mission_impact_1_0_0.md index 3b8f858a..e97cba5a 100644 --- a/docs/_generated/decision_points/mission_impact_1_0_0.md +++ b/docs/_generated/decision_points/mission_impact_1_0_0.md @@ -1,20 +1,20 @@ !!! note "Mission Impact v1.0.0" - === "Text" - - Impact on Mission Essential Functions of the Organization +=== "Text" + + Impact on Mission Essential Functions of the Organization - | Value | Definition | - |:-----|:-----------| - | None | Little to no impact | - | Non-Essential Degraded | Degradation of non-essential functions; chronic degradation would eventually harm essential functions | - | MEF Support Crippled | Activities that directly support essential functions are crippled; essential functions continue for a time | - | MEF Failure | Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time | - | Mission Failure | Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | None | Little to no impact | + | Non-Essential Degraded | Degradation of non-essential functions; chronic degradation would eventually harm essential functions | + | MEF Support Crippled | Activities that directly support essential functions are crippled; essential functions continue for a time | + | MEF Failure | Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time | + | Mission Failure | Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails | - ```json - {% include "../../../data/json/decision_points/mission_impact_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/mission_impact_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/mission_impact_2_0_0.md b/docs/_generated/decision_points/mission_impact_2_0_0.md index 72aa323f..4738bf7a 100644 --- a/docs/_generated/decision_points/mission_impact_2_0_0.md +++ b/docs/_generated/decision_points/mission_impact_2_0_0.md @@ -1,19 +1,19 @@ !!! note "Mission Impact v2.0.0" - === "Text" - - Impact on Mission Essential Functions of the Organization +=== "Text" + + Impact on Mission Essential Functions of the Organization - | Value | Definition | - |:-----|:-----------| - | Degraded | Little to no impact up to degradation of non-essential functions; chronic degradation would eventually harm essential functions | - | MEF Support Crippled | Activities that directly support essential functions are crippled; essential functions continue for a time | - | MEF Failure | Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time | - | Mission Failure | Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Degraded | Little to no impact up to degradation of non-essential functions; chronic degradation would eventually harm essential functions | + | MEF Support Crippled | Activities that directly support essential functions are crippled; essential functions continue for a time | + | MEF Failure | Any one mission essential function fails for period of time longer than acceptable; overall mission of the organization degraded but can still be accomplished for a time | + | Mission Failure | Multiple or all mission essential functions fail; ability to recover those functions degraded; organization’s ability to deliver its overall mission fails | - ```json - {% include "../../../data/json/decision_points/mission_impact_2_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/mission_impact_2_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/public_safety_impact_2_0_0.md b/docs/_generated/decision_points/public_safety_impact_2_0_0.md index f23c40af..4566df3b 100644 --- a/docs/_generated/decision_points/public_safety_impact_2_0_0.md +++ b/docs/_generated/decision_points/public_safety_impact_2_0_0.md @@ -1,17 +1,17 @@ !!! note "Public Safety Impact v2.0.0" - === "Text" - - A coarse-grained representation of impact to public safety. +=== "Text" + + A coarse-grained representation of impact to public safety. - | Value | Definition | - |:-----|:-----------| - | Minimal | Safety Impact:(None OR Minor) | - | Significant | Safety Impact:(Major OR Hazardous OR Catastrophic) | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Minimal | Safety Impact:(None OR Minor) | + | Significant | Safety Impact:(Major OR Hazardous OR Catastrophic) | - ```json - {% include "../../../data/json/decision_points/public_safety_impact_2_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/public_safety_impact_2_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/public_safety_impact_2_0_1.md b/docs/_generated/decision_points/public_safety_impact_2_0_1.md index 45546a2e..1d561484 100644 --- a/docs/_generated/decision_points/public_safety_impact_2_0_1.md +++ b/docs/_generated/decision_points/public_safety_impact_2_0_1.md @@ -1,17 +1,17 @@ !!! note "Public Safety Impact v2.0.1" - === "Text" - - A coarse-grained representation of impact to public safety. +=== "Text" + + A coarse-grained representation of impact to public safety. - | Value | Definition | - |:-----|:-----------| - | Minimal | Safety Impact:Negligible | - | Significant | Safety Impact:(Marginal OR Critical OR Catastrophic) | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Minimal | Safety Impact:Negligible | + | Significant | Safety Impact:(Marginal OR Critical OR Catastrophic) | - ```json - {% include "../../../data/json/decision_points/public_safety_impact_2_0_1.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/public_safety_impact_2_0_1.json" %} + ``` diff --git a/docs/_generated/decision_points/public_value_added_1_0_0.md b/docs/_generated/decision_points/public_value_added_1_0_0.md index 63d302cf..daa27817 100644 --- a/docs/_generated/decision_points/public_value_added_1_0_0.md +++ b/docs/_generated/decision_points/public_value_added_1_0_0.md @@ -1,18 +1,18 @@ !!! note "Public Value Added v1.0.0" - === "Text" - - How much value would a publication from the coordinator benefit the broader community? +=== "Text" + + How much value would a publication from the coordinator benefit the broader community? - | Value | Definition | - |:-----|:-----------| - | Limited | Minimal value added to the existing public information because existing information is already high quality and in multiple outlets. | - | Ampliative | Amplifies and/or augments the existing public information about the vulnerability, for example, adds additional detail, addresses or corrects errors in other public information, draws further attention to the vulnerability, etc. | - | Precedence | The publication would be the first publicly available, or be coincident with the first publicly available. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Limited | Minimal value added to the existing public information because existing information is already high quality and in multiple outlets. | + | Ampliative | Amplifies and/or augments the existing public information about the vulnerability, for example, adds additional detail, addresses or corrects errors in other public information, draws further attention to the vulnerability, etc. | + | Precedence | The publication would be the first publicly available, or be coincident with the first publicly available. | - ```json - {% include "../../../data/json/decision_points/public_value_added_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/public_value_added_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/public_well-being_impact_1_0_0.md b/docs/_generated/decision_points/public_well-being_impact_1_0_0.md index e3802f4c..ae6c11e5 100644 --- a/docs/_generated/decision_points/public_well-being_impact_1_0_0.md +++ b/docs/_generated/decision_points/public_well-being_impact_1_0_0.md @@ -1,18 +1,18 @@ !!! note "Public Well-Being Impact v1.0.0" - === "Text" - - A coarse-grained representation of impact to public well-being. +=== "Text" + + A coarse-grained representation of impact to public well-being. - | Value | Definition | - |:-----|:-----------| - | Minimal | The effect is below the threshold for all aspects described in material. | - | Material | Any one or more of these conditions hold. Physical harm: Does one or more of the following: (a) Causes physical distress or injury to system users. (b) Introduces occupational safety hazards. (c) Reduces and/or results in failure of cyber-physical system safety margins. Environment: Major externalities (property damage, environmental damage, etc.) are imposed on other parties. Financial: Financial losses likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to necessitate counseling or therapy, impact populations of people. | - | Irreversible | Any one or more of these conditions hold. Physical harm: One or both of the following are true: (a) Multiple fatalities are likely.(b) The cyber-physical system, of which the vulnerable componen is a part, is likely lost or destroyed. Environment: Extreme or serious externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) are imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software are destabilized and potentially collapse. Psychological: N/A | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Minimal | The effect is below the threshold for all aspects described in material. | + | Material | Any one or more of these conditions hold. Physical harm: Does one or more of the following: (a) Causes physical distress or injury to system users. (b) Introduces occupational safety hazards. (c) Reduces and/or results in failure of cyber-physical system safety margins. Environment: Major externalities (property damage, environmental damage, etc.) are imposed on other parties. Financial: Financial losses likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to necessitate counseling or therapy, impact populations of people. | + | Irreversible | Any one or more of these conditions hold. Physical harm: One or both of the following are true: (a) Multiple fatalities are likely.(b) The cyber-physical system, of which the vulnerable componen is a part, is likely lost or destroyed. Environment: Extreme or serious externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) are imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software are destabilized and potentially collapse. Psychological: N/A | - ```json - {% include "../../../data/json/decision_points/public_well-being_impact_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/public_well-being_impact_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/report_credibility_1_0_0.md b/docs/_generated/decision_points/report_credibility_1_0_0.md index 0d1ed805..09f5d64d 100644 --- a/docs/_generated/decision_points/report_credibility_1_0_0.md +++ b/docs/_generated/decision_points/report_credibility_1_0_0.md @@ -1,17 +1,17 @@ !!! note "Report Credibility v1.0.0" - === "Text" - - Is the report credible? +=== "Text" + + Is the report credible? - | Value | Definition | - |:-----|:-----------| - | Not Credible | The report is not credible. | - | Credible | The report is credible. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Not Credible | The report is not credible. | + | Credible | The report is credible. | - ```json - {% include "../../../data/json/decision_points/report_credibility_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/report_credibility_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/report_public_1_0_0.md b/docs/_generated/decision_points/report_public_1_0_0.md index 2f4a6c79..997c8d5e 100644 --- a/docs/_generated/decision_points/report_public_1_0_0.md +++ b/docs/_generated/decision_points/report_public_1_0_0.md @@ -1,17 +1,17 @@ !!! note "Report Public v1.0.0" - === "Text" - - Is a viable report of the details of the vulnerability already publicly available? +=== "Text" + + Is a viable report of the details of the vulnerability already publicly available? - | Value | Definition | - |:-----|:-----------| - | Yes | A public report of the vulnerability exists. | - | No | No public report of the vulnerability exists. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Yes | A public report of the vulnerability exists. | + | No | No public report of the vulnerability exists. | - ```json - {% include "../../../data/json/decision_points/report_public_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/report_public_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/safety_impact_1_0_0.md b/docs/_generated/decision_points/safety_impact_1_0_0.md index 53f9868c..0575b6e1 100644 --- a/docs/_generated/decision_points/safety_impact_1_0_0.md +++ b/docs/_generated/decision_points/safety_impact_1_0_0.md @@ -1,20 +1,20 @@ !!! note "Safety Impact v1.0.0" - === "Text" - - The safety impact of the vulnerability. +=== "Text" + + The safety impact of the vulnerability. - | Value | Definition | - |:-----|:-----------| - | None | The effect is below the threshold for all aspects described in Minor. | - | Minor | Any one or more of these conditions hold. Physical harm: Physical discomfort for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. System resiliency: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. Environment: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. Financial Financial losses, which are not readily absorbable, to multiple persons. Psychological: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons. | - | Major | Any one or more of these conditions hold. Physical harm: Physical distress and injuries for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. System resiliency: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. Environment: Major externalities (property damage, environmental damage, etc.) imposed on other parties. Financial: Financial losses that likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people. | - | Hazardous | Any one or more of these conditions hold. Physical harm: Serious or fatal injuries, where fatalities are plausibly preventable via emergency services or other measures. Operator resiliency: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. System resiliency: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. Environment: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. Financial: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. Psychological: N/A. | - | Catastrophic | Any one or more of these conditions hold. Physical harm: Multiple immediate fatalities (Emergency response probably cannot save the victims.) Operator resiliency: Operator incapacitated (includes fatality or otherwise incapacitated). System resiliency: Total loss of whole cyber-physical system, of which the software is a part. Environment: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software collapse. Psychological: N/A. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | None | The effect is below the threshold for all aspects described in Minor. | + | Minor | Any one or more of these conditions hold. Physical harm: Physical discomfort for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard. System resiliency: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation. Environment: Minor externalities (property damage, environmental damage, etc.) imposed on other parties. Financial Financial losses, which are not readily absorbable, to multiple persons. Psychological: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons. | + | Major | Any one or more of these conditions hold. Physical harm: Physical distress and injuries for users (not operators) of the system. Operator resiliency: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard. System resiliency: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation. Environment: Major externalities (property damage, environmental damage, etc.) imposed on other parties. Financial: Financial losses that likely lead to bankruptcy of multiple persons. Psychological: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people. | + | Hazardous | Any one or more of these conditions hold. Physical harm: Serious or fatal injuries, where fatalities are plausibly preventable via emergency services or other measures. Operator resiliency: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly. System resiliency: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact. Environment: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties. Financial: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state. Psychological: N/A. | + | Catastrophic | Any one or more of these conditions hold. Physical harm: Multiple immediate fatalities (Emergency response probably cannot save the victims.) Operator resiliency: Operator incapacitated (includes fatality or otherwise incapacitated). System resiliency: Total loss of whole cyber-physical system, of which the software is a part. Environment: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties. Financial: Social systems (elections, financial grid, etc.) supported by the software collapse. Psychological: N/A. | - ```json - {% include "../../../data/json/decision_points/safety_impact_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/safety_impact_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/safety_impact_2_0_0.md b/docs/_generated/decision_points/safety_impact_2_0_0.md index a13fb828..61326a77 100644 --- a/docs/_generated/decision_points/safety_impact_2_0_0.md +++ b/docs/_generated/decision_points/safety_impact_2_0_0.md @@ -1,19 +1,19 @@ !!! note "Safety Impact v2.0.0" - === "Text" - - The safety impact of the vulnerability. (based on IEC 61508) +=== "Text" + + The safety impact of the vulnerability. (based on IEC 61508) - | Value | Definition | - |:-----|:-----------| - | Negligible | Any one or more of these conditions hold.

- *Physical harm*: Minor injuries at worst (IEC 61508 Negligible).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard.
- *System resiliency*: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation.
- *Environment*: Minor externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses, which are not readily absorbable, to multiple persons.
- *Psychological*: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons. | - | Marginal | Any one or more of these conditions hold.

- *Physical harm*: Major injuries to one or more persons (IEC 61508 Marginal).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard.
- *System resiliency*: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation.
- *Environment*: Major externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses that likely lead to bankruptcy of multiple persons.
- *Psychological*: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people. | - | Critical | Any one or more of these conditions hold.

- *Physical harm*: Loss of life (IEC 61508 Critical).
- *Operator resiliency*: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly.
- *System resiliency*: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact.
- *Environment*: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties.
- *Financial*: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state.
- *Psychological*: N/A. | - | Catastrophic | Any one or more of these conditions hold.

- *Physical harm*: Multiple loss of life (IEC 61508 Catastrophic).
- *Operator resiliency*: Operator incapacitated (includes fatality or otherwise incapacitated).
- *System resiliency*: Total loss of whole cyber-physical system, of which the software is a part.
- *Environment*: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties.
- *Financial*: Social systems (elections, financial grid, etc.) supported by the software collapse.
- *Psychological*: N/A. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Negligible | Any one or more of these conditions hold.

- *Physical harm*: Minor injuries at worst (IEC 61508 Negligible).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be well within expected operator abilities; OR causes a minor occupational safety hazard.
- *System resiliency*: Small reduction in built-in system safety margins; OR small reduction in system functional capabilities that support safe operation.
- *Environment*: Minor externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses, which are not readily absorbable, to multiple persons.
- *Psychological*: Emotional or psychological harm, sufficient to be cause for counselling or therapy, to multiple persons. | + | Marginal | Any one or more of these conditions hold.

- *Physical harm*: Major injuries to one or more persons (IEC 61508 Marginal).
- *Operator resiliency*: Requires action by system operator to maintain safe system state as a result of exploitation of the vulnerability where operator actions would be within their capabilities but the actions require their full attention and effort; OR significant distraction or discomfort to operators; OR causes significant occupational safety hazard.
- *System resiliency*: System safety margin effectively eliminated but no actual harm; OR failure of system functional capabilities that support safe operation.
- *Environment*: Major externalities (property damage, environmental damage, etc.) imposed on other parties.
- *Financial*: Financial losses that likely lead to bankruptcy of multiple persons.
- *Psychological*: Widespread emotional or psychological harm, sufficient to be cause for counselling or therapy, to populations of people. | + | Critical | Any one or more of these conditions hold.

- *Physical harm*: Loss of life (IEC 61508 Critical).
- *Operator resiliency*: Actions that would keep the system in a safe state are beyond system operator capabilities, resulting in adverse conditions; OR great physical distress to system operators such that they cannot be expected to operate the system properly.
- *System resiliency*: Parts of the cyber-physical system break; system’s ability to recover lost functionality remains intact.
- *Environment*: Serious externalities (threat to life as well as property, widespread environmental damage, measurable public health risks, etc.) imposed on other parties.
- *Financial*: Socio-technical system (elections, financial grid, etc.) of which the affected component is a part is actively destabilized and enters unsafe state.
- *Psychological*: N/A. | + | Catastrophic | Any one or more of these conditions hold.

- *Physical harm*: Multiple loss of life (IEC 61508 Catastrophic).
- *Operator resiliency*: Operator incapacitated (includes fatality or otherwise incapacitated).
- *System resiliency*: Total loss of whole cyber-physical system, of which the software is a part.
- *Environment*: Extreme externalities (immediate public health threat, environmental damage leading to small ecosystem collapse, etc.) imposed on other parties.
- *Financial*: Social systems (elections, financial grid, etc.) supported by the software collapse.
- *Psychological*: N/A. | - ```json - {% include "../../../data/json/decision_points/safety_impact_2_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/safety_impact_2_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/supplier_cardinality_1_0_0.md b/docs/_generated/decision_points/supplier_cardinality_1_0_0.md index 9dbdc154..91874a69 100644 --- a/docs/_generated/decision_points/supplier_cardinality_1_0_0.md +++ b/docs/_generated/decision_points/supplier_cardinality_1_0_0.md @@ -1,17 +1,17 @@ !!! note "Supplier Cardinality v1.0.0" - === "Text" - - How many suppliers are responsible for the vulnerable component and its remediation or mitigation plan? +=== "Text" + + How many suppliers are responsible for the vulnerable component and its remediation or mitigation plan? - | Value | Definition | - |:-----|:-----------| - | One | There is only one supplier of the vulnerable component. | - | Multiple | There are multiple suppliers of the vulnerable component. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | One | There is only one supplier of the vulnerable component. | + | Multiple | There are multiple suppliers of the vulnerable component. | - ```json - {% include "../../../data/json/decision_points/supplier_cardinality_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/supplier_cardinality_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/supplier_contacted_1_0_0.md b/docs/_generated/decision_points/supplier_contacted_1_0_0.md index aff63ba8..57964ada 100644 --- a/docs/_generated/decision_points/supplier_contacted_1_0_0.md +++ b/docs/_generated/decision_points/supplier_contacted_1_0_0.md @@ -1,17 +1,17 @@ !!! note "Supplier Contacted v1.0.0" - === "Text" - - Has the reporter made a good-faith effort to contact the supplier of the vulnerable component using a quality contact method? +=== "Text" + + Has the reporter made a good-faith effort to contact the supplier of the vulnerable component using a quality contact method? - | Value | Definition | - |:-----|:-----------| - | No | The supplier has not been contacted. | - | Yes | The supplier has been contacted. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | No | The supplier has not been contacted. | + | Yes | The supplier has been contacted. | - ```json - {% include "../../../data/json/decision_points/supplier_contacted_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/supplier_contacted_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/supplier_engagement_1_0_0.md b/docs/_generated/decision_points/supplier_engagement_1_0_0.md index 2d3d9d18..4ab0298f 100644 --- a/docs/_generated/decision_points/supplier_engagement_1_0_0.md +++ b/docs/_generated/decision_points/supplier_engagement_1_0_0.md @@ -1,17 +1,17 @@ !!! note "Supplier Engagement v1.0.0" - === "Text" - - Is the supplier responding to the reporter’s contact effort and actively participating in the coordination effort? +=== "Text" + + Is the supplier responding to the reporter’s contact effort and actively participating in the coordination effort? - | Value | Definition | - |:-----|:-----------| - | Active | The supplier is responding to the reporter’s contact effort and actively participating in the coordination effort. | - | Unresponsive | The supplier is not responding to the reporter’s contact effort and not actively participating in the coordination effort. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Active | The supplier is responding to the reporter’s contact effort and actively participating in the coordination effort. | + | Unresponsive | The supplier is not responding to the reporter’s contact effort and not actively participating in the coordination effort. | - ```json - {% include "../../../data/json/decision_points/supplier_engagement_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/supplier_engagement_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/supplier_involvement_1_0_0.md b/docs/_generated/decision_points/supplier_involvement_1_0_0.md index 3e7504b2..d11d3d6d 100644 --- a/docs/_generated/decision_points/supplier_involvement_1_0_0.md +++ b/docs/_generated/decision_points/supplier_involvement_1_0_0.md @@ -1,18 +1,18 @@ !!! note "Supplier Involvement v1.0.0" - === "Text" - - What is the state of the supplier’s work on addressing the vulnerability? +=== "Text" + + What is the state of the supplier’s work on addressing the vulnerability? - | Value | Definition | - |:-----|:-----------| - | Fix Ready | The supplier has provided a patch or fix. | - | Cooperative | The supplier is actively generating a patch or fix; they may or may not have provided a mitigation or work-around in the mean time. | - | Uncooperative/Unresponsive | The supplier has not responded, declined to generate a remediation, or no longer exists. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Fix Ready | The supplier has provided a patch or fix. | + | Cooperative | The supplier is actively generating a patch or fix; they may or may not have provided a mitigation or work-around in the mean time. | + | Uncooperative/Unresponsive | The supplier has not responded, declined to generate a remediation, or no longer exists. | - ```json - {% include "../../../data/json/decision_points/supplier_involvement_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/supplier_involvement_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/system_exposure_1_0_0.md b/docs/_generated/decision_points/system_exposure_1_0_0.md index 4c6e977c..f5d02ec8 100644 --- a/docs/_generated/decision_points/system_exposure_1_0_0.md +++ b/docs/_generated/decision_points/system_exposure_1_0_0.md @@ -1,18 +1,18 @@ !!! note "System Exposure v1.0.0" - === "Text" - - The Accessible Attack Surface of the Affected System or Service +=== "Text" + + The Accessible Attack Surface of the Affected System or Service - | Value | Definition | - |:-----|:-----------| - | Small | Local service or program; highly controlled network | - | Controlled | Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small. | - | Unavoidable | Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers) | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Small | Local service or program; highly controlled network | + | Controlled | Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small. | + | Unavoidable | Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers) | - ```json - {% include "../../../data/json/decision_points/system_exposure_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/system_exposure_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/system_exposure_1_0_1.md b/docs/_generated/decision_points/system_exposure_1_0_1.md index 234fa98a..a24beb92 100644 --- a/docs/_generated/decision_points/system_exposure_1_0_1.md +++ b/docs/_generated/decision_points/system_exposure_1_0_1.md @@ -1,18 +1,18 @@ !!! note "System Exposure v1.0.1" - === "Text" - - The Accessible Attack Surface of the Affected System or Service +=== "Text" + + The Accessible Attack Surface of the Affected System or Service - | Value | Definition | - |:-----|:-----------| - | Small | Local service or program; highly controlled network | - | Controlled | Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small. | - | Open | Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers) | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Small | Local service or program; highly controlled network | + | Controlled | Networked service with some access restrictions or mitigations already in place (whether locally or on the network). A successful mitigation must reliably interrupt the adversary’s attack, which requires the attack is detectable both reliably and quickly enough to respond. Controlled covers the situation in which a vulnerability can be exploited through chaining it with other vulnerabilities. The assumption is that the number of steps in the attack path is relatively low; if the path is long enough that it is implausible for an adversary to reliably execute it, then exposure should be small. | + | Open | Internet or another widely accessible network where access cannot plausibly be restricted or controlled (e.g., DNS servers, web servers, VOIP servers, email servers) | - ```json - {% include "../../../data/json/decision_points/system_exposure_1_0_1.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/system_exposure_1_0_1.json" %} + ``` diff --git a/docs/_generated/decision_points/technical_impact_1_0_0.md b/docs/_generated/decision_points/technical_impact_1_0_0.md index 13603ec8..543f744d 100644 --- a/docs/_generated/decision_points/technical_impact_1_0_0.md +++ b/docs/_generated/decision_points/technical_impact_1_0_0.md @@ -1,17 +1,17 @@ !!! note "Technical Impact v1.0.0" - === "Text" - - The technical impact of the vulnerability. +=== "Text" + + The technical impact of the vulnerability. - | Value | Definition | - |:-----|:-----------| - | Partial | The exploit gives the adversary limited control over, or information exposure about, the behavior of the software that contains the vulnerability. Or the exploit gives the adversary an importantly low stochastic opportunity for total control. | - | Total | The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Partial | The exploit gives the adversary limited control over, or information exposure about, the behavior of the software that contains the vulnerability. Or the exploit gives the adversary an importantly low stochastic opportunity for total control. | + | Total | The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability. | - ```json - {% include "../../../data/json/decision_points/technical_impact_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/technical_impact_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/utility_1_0_0.md b/docs/_generated/decision_points/utility_1_0_0.md index 0678ec6c..f05120fa 100644 --- a/docs/_generated/decision_points/utility_1_0_0.md +++ b/docs/_generated/decision_points/utility_1_0_0.md @@ -1,18 +1,18 @@ !!! note "Utility v1.0.0" - === "Text" - - The Usefulness of the Exploit to the Adversary +=== "Text" + + The Usefulness of the Exploit to the Adversary - | Value | Definition | - |:-----|:-----------| - | Laborious | Virulence:Slow and Value Density:Diffuse | - | Efficient | Virulence:Rapid and Value Density:Diffuse OR Virulence:Slow and Value Density:Concentrated | - | Super Effective | Virulence:Rapid and Value Density:Concentrated | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Laborious | Virulence:Slow and Value Density:Diffuse | + | Efficient | Virulence:Rapid and Value Density:Diffuse OR Virulence:Slow and Value Density:Concentrated | + | Super Effective | Virulence:Rapid and Value Density:Concentrated | - ```json - {% include "../../../data/json/decision_points/utility_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/utility_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/utility_1_0_1.md b/docs/_generated/decision_points/utility_1_0_1.md index 6ffb2611..3111782d 100644 --- a/docs/_generated/decision_points/utility_1_0_1.md +++ b/docs/_generated/decision_points/utility_1_0_1.md @@ -1,18 +1,18 @@ !!! note "Utility v1.0.1" - === "Text" - - The Usefulness of the Exploit to the Adversary +=== "Text" + + The Usefulness of the Exploit to the Adversary - | Value | Definition | - |:-----|:-----------| - | Laborious | Automatable:No AND Value Density:Diffuse | - | Efficient | (Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated) | - | Super Effective | Automatable:Yes AND Value Density:Concentrated | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Laborious | Automatable:No AND Value Density:Diffuse | + | Efficient | (Automatable:Yes AND Value Density:Diffuse) OR (Automatable:No AND Value Density:Concentrated) | + | Super Effective | Automatable:Yes AND Value Density:Concentrated | - ```json - {% include "../../../data/json/decision_points/utility_1_0_1.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/utility_1_0_1.json" %} + ``` diff --git a/docs/_generated/decision_points/value_density_1_0_0.md b/docs/_generated/decision_points/value_density_1_0_0.md index c1351297..e23853ce 100644 --- a/docs/_generated/decision_points/value_density_1_0_0.md +++ b/docs/_generated/decision_points/value_density_1_0_0.md @@ -1,17 +1,17 @@ !!! note "Value Density v1.0.0" - === "Text" - - The concentration of value in the target +=== "Text" + + The concentration of value in the target - | Value | Definition | - |:-----|:-----------| - | Diffuse | The system that contains the vulnerable component has limited resources. That is, the resources that the adversary will gain control over with a single exploitation event are relatively small. | - | Concentrated | The system that contains the vulnerable component is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Diffuse | The system that contains the vulnerable component has limited resources. That is, the resources that the adversary will gain control over with a single exploitation event are relatively small. | + | Concentrated | The system that contains the vulnerable component is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users. | - ```json - {% include "../../../data/json/decision_points/value_density_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/value_density_1_0_0.json" %} + ``` diff --git a/docs/_generated/decision_points/virulence_1_0_0.md b/docs/_generated/decision_points/virulence_1_0_0.md index 63e7497f..a8c231ee 100644 --- a/docs/_generated/decision_points/virulence_1_0_0.md +++ b/docs/_generated/decision_points/virulence_1_0_0.md @@ -1,17 +1,17 @@ !!! note "Virulence v1.0.0" - === "Text" - - The speed at which the vulnerability can be exploited. +=== "Text" + + The speed at which the vulnerability can be exploited. - | Value | Definition | - |:-----|:-----------| - | Slow | Steps 1-4 of the kill chain cannot be reliably automated for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation. | - | Rapid | Steps 1-4 of the of the kill chain can be reliably automated. If the vulnerability allows remote code execution or command injection, the default response should be rapid. | - - === "JSON" + | Value | Definition | + |:-----|:-----------| + | Slow | Steps 1-4 of the kill chain cannot be reliably automated for this vulnerability for some reason. These steps are reconnaissance, weaponization, delivery, and exploitation. | + | Rapid | Steps 1-4 of the of the kill chain can be reliably automated. If the vulnerability allows remote code execution or command injection, the default response should be rapid. | - ```json - {% include "../../../data/json/decision_points/virulence_1_0_0.json" %} - ``` +=== "JSON" + + ```json + {% include "../../../data/json/decision_points/virulence_1_0_0.json" %} + ``` diff --git a/src/ssvc/doctools.py b/src/ssvc/doctools.py index 6ea50a53..5baca11b 100644 --- a/src/ssvc/doctools.py +++ b/src/ssvc/doctools.py @@ -59,15 +59,15 @@ def _filename_friendly(name: str) -> str: MD_INCLUDE_TEMPLATE = """ !!! note "{dp.name} v{dp.version}" - === "Text" - - {table} - - === "JSON" +=== "Text" + +{table} - ```json - {{% include "{json_file}" %}} - ``` +=== "JSON" + + ```json + {{% include "{json_file}" %}} + ``` """ @@ -83,9 +83,9 @@ def to_markdown_table(dp: SsvcDecisionPoint) -> str: """ rows = [] # prepend the header - rows.append(f"{dp.description}") + rows.append(f" {dp.description}") rows.append("") - indent = " " * 8 + indent = " " * 4 rows.append(f"{indent}| Value | Definition |") rows.append(f"{indent}|:-----|:-----------|")