Re: [spdx-defects] [spdx] VEX integration in SPDX #spdx


Dick Brooks
 

Sandeep,

 

A good example of a VEX advisory is provided by Siemens in their log4j advisory:

https://cert-portal.siemens.com/productcert/csaf/ssa-661247.json

 

NOTE: VEX’s are vulnerability centric, where a vulnerability is reported and a vendor issues a VEX.

 

It’s important to note that a VEX is very different from a product centric vulnerability disclosure report (VDR) which NIST requires for Executive Order 14028.

 

If you plan to sell products to the US Government then you will need to follow NIST’s requirements for Executive Order 14028:

https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-security-supply-chains-software-1

 

Maintain vendor vulnerability disclosure reports at the SBOM component level

 

Here is the difference between a VEX and a VDR (attestation).

A VEX is an artifact showing the status of vulnerabilities within a product or products. Components with no vulnerabilities are not listed in a VEX, unless there is a "known not affected" status listed in the VEX.

A VDR is an attestation by a software vendor that they have checked each component of a software product in an SBOM for vulnerabilities and reports on the vulnerability status of each component, for a software product. A VDR is dynamically updated and maintained by the software vendor in order to answer the consumer question "What is the vulnerability status of Product P, NOW?"

 

Thanks,

 

Dick Brooks

 

Active Member of the CISA Critical Manufacturing Sector,

Sector Coordinating Council – A Public-Private Partnership

 

Never trust software, always verify and report!

http://www.reliableenergyanalytics.com

Email: dick@...

Tel: +1 978-696-1788

 

From: spdx@... <spdx@...> On Behalf Of Jeff Schutt (jefschut) via lists.spdx.org
Sent: Thursday, June 2, 2022 1:40 PM
To: spdx@...; sandeep.patil@...; spdx-defects@...
Subject: Re: [spdx-defects] [spdx] VEX integration in SPDX #spdx

 

Hi Sandeep,

 

To add to Rose’s comments…

 

For version 2.3, the new Advisory identifier (F.2.3) is a catch-all that will enable linking to any VEX information, e.g., as contained within OSV or CSAF file.

 

We’re currently working on further security vulnerability information integrations with version 3.0 of the SPDX spec and would welcome your contributions :) Meetings are Wednesdays at 11am PT.

 

Jeff

 

 

From: <spdx@...> on behalf of "Rose Judge via lists.spdx.org" <rjudge=vmware.com@...>
Reply-To: "spdx@..." <spdx@...>
Date: Thursday, June 2, 2022 at 10:30 AM
To: "spdx@..." <spdx@...>, "sandeep.patil@..." <sandeep.patil@...>, "spdx-defects@..." <spdx-defects@...>
Subject: Re: [spdx-defects] [spdx] VEX integration in SPDX #spdx

 

Hi Sandeep,

 

The SPDX Defects working group announced security enhancements to the ExternalReference section of the spec as well as an explanatory Annex about how to include security information in an SPDX document. These changes apply to spec version 2.3 which should be released by the end of the month.

 

In order to include security/vulnerability information in 2.3, you will want to use the SECURITY ExternalReference Type. When using this format, there’s several security identifiers available: cpe22type, cpe23type, advisory, fix, url or swid that you can use to reference a VEX document. You can see examples of how this might be done in the link to Annex G above.

 

I’m also adding the SPDX Defects workgroup to the CC in case you have any further questions.

 

Thanks,

Rose

 

 

Subject:

[EXT] [spdx] VEX integration in SPDX #spdx

Date:

Tue, 31 May 2022 22:49:51 -0700

From:

Patil, Sandeep via lists.spdx.org <sandeep.patil=philips.com@...>

Reply-To:

spdx@...

To:

spdx@...



Hi , 
Is there any roadmap to integrate VEX to  with SPDX ? Or is there already way in current SPDX specification to integrate vulnerability information ? 


Regards
Sandeep 

 


Join spdx@lists.spdx.org to automatically receive all group messages.