CVE Auditing With VEX #102
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: naibu3 <[email protected]>
|
@HoussemNasri I would appreciate if you could also take a look here. |
CDellaGiusta
approved these changes
Feb 28, 2025
|
|
||
| - **CSAF**, maintained by OASIS. Supports rich metadata, including product information, vulnerabilities, and remediation guidance. | ||
| - **CycloneDX**, is maintained by OWASP. Focuses on simplicity and interoperability. (Can be JSON or XML-based) | ||
| - **OpenVEX**, designed specifically for simplicity and ease of use. It is maintained by the OpenVEX community. |
There was a problem hiding this comment.
I strongly recommend CycloneDX, because as you said is maintained by OWASP.
I'd also suggest to check whether we could use a system like DependencyTracker (https://docs.dependencytrack.org/) to identify and reduce risk in the software supply chain.
rjmateus
reviewed
Feb 28, 2025
|
|
||
| ### VEX Downloader | ||
|
|
||
| Retrieve VEX documents online. Is responsible finding, downloading and caching the files, like was done for OVAL [^2]. |
There was a problem hiding this comment.
I would add a line saying that the data will be processed in stream, to avoid any memory issues.3
rjmateus
approved these changes
Mar 3, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
VEX consumption in CVE audits
The aim of the project is to enhance CVE auditing accuracy using VEX profile.
Read rendered RFC.