fix: handle unknown values in metric_finder (Fixes #4578)

cve_bin_tool/cvedb.py

@@ -45,6 +45,7 @@
 DBNAME = "cve.db"
 OLD_CACHE_DIR = Path("~") / ".cache" / "cvedb"
 
+UNKNOWN_METRIC_ID = 0
 EPSS_METRIC_ID = 1
 CVSS_2_METRIC_ID = 2
 CVSS_3_METRIC_ID = 3
@@ -416,6 +417,8 @@ def init_database(self) -> None:
         for table in self.TABLE_SCHEMAS:
             cursor.execute(self.TABLE_SCHEMAS[table])
 
+        # Ensure the UNKNOWN metric exists
+        self.ensure_unknown_metric(cursor)
         # add indexes
         for index in self.INDEXES:
             cursor.execute(self.INDEXES[index])
@@ -619,6 +622,7 @@ def populate_metrics(self):
         # Insert a row without specifying cve_metrics_id
         insert_metrics = self.INSERT_QUERIES["insert_metrics"]
         data = [
+            (UNKNOWN_METRIC_ID, "UNKNOWN"),
             (EPSS_METRIC_ID, "EPSS"),
             (CVSS_2_METRIC_ID, "CVSS-2"),
             (CVSS_3_METRIC_ID, "CVSS-3"),
@@ -632,15 +636,15 @@ def populate_metrics(self):
     def metric_finder(self, cursor, cve):
         """
         SQL query to retrieve the metrics_name based on the metrics_id
-        currently cve["CVSS_version"] return 2,3 based on there version and they are mapped accordingly to there metrics name in metrics table.
+        currently cve["CVSS_version"] return 2,3 based on their version and they are mapped accordingly to their metrics name in metrics table.
         """
         query = """
         SELECT metrics_id FROM metrics
         WHERE metrics_id=?
         """
         metric = None
         if cve["CVSS_version"] == "unknown":
-            metric = "unknown"
+            metric = 0
         else:
             cursor.execute(query, [cve.get("CVSS_version")])
             # Fetch all the results of the query and use 'map' to extract only the 'metrics_name' from the result
@@ -1173,8 +1177,18 @@ def fetch_from_mirror(self, mirror, pubkey, ignore_signature, log_signature_erro
 
     @contextlib.contextmanager
     def with_cursor(self):
+        """Context manager for database cursor."""
         cursor = self.db_open_and_get_cursor()
         try:
             yield cursor
         finally:
             self.db_close()
+
+    def ensure_unknown_metric(self, cursor):
+        """Ensure that the UNKNOWN metric exists in the metrics table."""
+        insert_metrics = self.INSERT_QUERIES["insert_metrics"]
+        try:
+            cursor.execute(insert_metrics, (UNKNOWN_METRIC_ID, "UNKNOWN"))
+        except sqlite3.IntegrityError:
+            # The metric already exists, no action needed
+            pass