fix(cyclonedx): include CVSS v4 vulnerability ratings (aquasecurity#10313)

Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>

Author: drawliin

pkg/sbom/cyclonedx/marshal.go

@@ -488,6 +488,9 @@ func (m *Marshaler) ratings(vuln core.Vulnerability) *[]cdx.VulnerabilityRating
 			if cvss.V3Score != 0 || cvss.V3Vector != "" {
 				rates = append(rates, m.ratingV3(sourceID, severity, cvss))
 			}
+			if cvss.V40Score != 0 || cvss.V40Vector != "" {
+				rates = append(rates, m.ratingV4(sourceID, severity, cvss))
+			}
 		} else { // When the vendor provides only severity
 			rate := cdx.VulnerabilityRating{
 				Source: &cdx.Source{
@@ -550,6 +553,18 @@ func (m *Marshaler) ratingV3(sourceID dtypes.SourceID, severity dtypes.Severity,
 	return rate
 }
 
+func (m *Marshaler) ratingV4(sourceID dtypes.SourceID, severity dtypes.Severity, cvss dtypes.CVSS) cdx.VulnerabilityRating {
+	return cdx.VulnerabilityRating{
+		Source: &cdx.Source{
+			Name: string(sourceID),
+		},
+		Score:    &cvss.V40Score,
+		Method:   cdx.ScoringMethodCVSSv4,
+		Severity: m.severity(severity),
+		Vector:   cvss.V40Vector,
+	}
+}
+
 // severity converts the Trivy severity to the CycloneDX severity
 func (*Marshaler) severity(s dtypes.Severity) cdx.Severity {
 	switch s {

pkg/sbom/cyclonedx/marshal_test.go

@@ -1567,8 +1567,10 @@ func TestMarshaler_MarshalReport(t *testing.T) {
 									},
 									CVSS: dtypes.VendorCVSS{
 										vulnerability.GHSA: dtypes.CVSS{
-											V3Vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
-											V3Score:  7.5,
+											V3Vector:  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+											V3Score:   7.5,
+											V40Vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+											V40Score:  8.7,
 										},
 									},
 									References: []string{
@@ -1655,6 +1657,15 @@ func TestMarshaler_MarshalReport(t *testing.T) {
 								Method:   cdx.ScoringMethodCVSSv31,
 								Vector:   "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
 							},
+							{
+								Source: &cdx.Source{
+									Name: string(vulnerability.GHSA),
+								},
+								Score:    lo.ToPtr(8.7),
+								Severity: cdx.SeverityHigh,
+								Method:   cdx.ScoringMethodCVSSv4,
+								Vector:   "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
+							},
 						},
 						Description: "In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.",
 						Advisories: &[]cdx.Advisory{