diff --git a/cve_bin_tool/data_sources/nvd_source.py b/cve_bin_tool/data_sources/nvd_source.py index 1ee0a4d34b..54f5395fdc 100644 --- a/cve_bin_tool/data_sources/nvd_source.py +++ b/cve_bin_tool/data_sources/nvd_source.py @@ -310,12 +310,15 @@ def format_data_api2(self, all_cve_entries): ) cve["severity"] = re.sub(r"[\W]", "", cve["severity"]) - # score should be numeric - try: - cve["score"] = float(cve["score"]) - except ValueError: - self.logger.debug(f"Score for {cve['id']} is invalid: {cve['score']}") - cve["score"] = "invalid" + # score should be numeric, except when score is "unknown" + if cve["score"] != "unknown": + try: + cve["score"] = float(cve["score"]) + except ValueError: + self.logger.debug( + f"Score for {cve['id']} is invalid: {cve['score']}" + ) + cve["score"] = "invalid" # CVSS_vector will be validated/normalized when cvss library is used but # we can at least do a character filter here