Improper Input Validation in CVSS v2 parsing

[pandatix]

While fuzzing this implementation, I discovered that some invalid inputs did not raise errors.
This could be categorized as CWE-20.

For instance, the following Go code does not produce any error.

package main

import (
	"fmt"

	"github.com/facebookincubator/nvdtools/cvss2"
)

func main() {
	vec, err := cvss2.VectorFromString("AV:A/AC:L/Au:N/C:C/I:C/A:C/CDP:H/TD:H/CR:H")

	fmt.Printf("vec: %v\n", vec)
	fmt.Printf("err: %v\n", err)
}

produces ->

vec: (AV:A/AC:L/Au:N/C:C/I:C/A:C/CDP:H/TD:H/CR:H)
err: <nil>

You can check this input is invalid, using the NVD calculator which displays the vector with all environmental metrics when given this vector, or by looking at the specification Table 13 which shows the environmental vector must contain all metrics when in the CVSS vector.

Found using version/tag v0.1.5.