Sandeep,
NIST also recommends that vendors and consumers “Maintain vendor vulnerability disclosure reports at the SBOM component level.” See 5/5 guidance: https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-security-supply-chains-software-1 SPDX V 2.3 supports both VEX and Vulnerability Disclosure Reports (VDR), in support of the NIST recommendations for Executive Order 14028. Here’s an example SPDX V 2.3 reference to a VDR: ExternalRef SECURITY advisory https://github.com/rjb4standards/REA-Products/blob/master/SBOMVDR_JSON/VDR_118.json Here’s an example SPDX V 2.3 reference to a VEX: ExternalRef SECURITY advisory https://cert-portal.siemens.com/productcert/csaf/ssa-661247.json Here’s an explanation of the difference between VEX and VDR: In summary a VEX is an artifact showing the status of vulnerabilities within a product. Components with no vulnerabilities are not listed in a VEX, unless there is a "known not affected" product status contained in the VEX. In summary, a VDR is an attestation by a software vendor that they have checked each component in a software product SBOM for vulnerabilities and reports on the vulnerability status of each component, for a software product. Thanks, Dick Brooks Active Member of the CISA Critical Manufacturing Sector, Sector Coordinating Council – A Public-Private Partnership <https://reliableenergyanalytics.com/products> Never trust software, always verify and report! ™ <http://www.reliableenergyanalytics.com/> http://www.reliableenergyanalytics.com Email: <mailto:[email protected]> [email protected] Tel: +1 978-696-1788 From: [email protected] <[email protected]> On Behalf Of Jeff Schutt (jefschut) via lists.spdx.org Sent: Thursday, June 2, 2022 1:40 PM To: [email protected]; [email protected]; [email protected] Subject: Re: [spdx-defects] [spdx] VEX integration in SPDX #spdx Hi Sandeep, To add to Rose’s comments… For version 2.3, the new Advisory identifier (F.2.3 <https://github.com/spdx/spdx-spec/blob/b57e348b19b4ba03474c7293f2c5b86878e23d4c/chapters/external-repository-identifiers.md#f23-advisory-> ) is a catch-all that will enable linking to any VEX information, e.g., as contained within OSV or CSAF file. We’re currently working on further security vulnerability information integrations with version 3.0 of the SPDX spec and would welcome your contributions :) Meetings are Wednesdays at 11am PT. Jeff From: <[email protected] <mailto:[email protected]> > on behalf of "Rose Judge via lists.spdx.org" <[email protected] <mailto:[email protected]> > Reply-To: "[email protected] <mailto:[email protected]> " <[email protected] <mailto:[email protected]> > Date: Thursday, June 2, 2022 at 10:30 AM To: "[email protected] <mailto:[email protected]> " <[email protected] <mailto:[email protected]> >, "[email protected] <mailto:[email protected]> " <[email protected] <mailto:[email protected]> >, "[email protected] <mailto:[email protected]> " <[email protected] <mailto:[email protected]> > Subject: Re: [spdx-defects] [spdx] VEX integration in SPDX #spdx Hi Sandeep, The SPDX Defects working group announced security enhancements to the ExternalReference section <https://github.com/spdx/spdx-spec/blob/b57e348b19b4ba03474c7293f2c5b86878e23d4c/chapters/external-repository-identifiers.md#f2-security-> of the spec as well as an explanatory Annex about how to include security information in an SPDX document <https://github.com/spdx/spdx-spec/blob/e25d183ade64c123770412297b9bf5086a7ed0bf/chapters/how-to-use.md#g1-including-security-information-in-a-spdx-document> . These changes apply to spec version 2.3 which should be released by the end of the month. In order to include security/vulnerability information in 2.3, you will want to use the SECURITY ExternalReference Type. When using this format, there’s several security identifiers available: cpe22type, cpe23type, advisory, fix, url or swid that you can use to reference a VEX document. You can see examples of how this might be done in the link to Annex G above. I’m also adding the SPDX Defects workgroup to the CC in case you have any further questions. Thanks, Rose Subject: [EXT] [spdx] VEX integration in SPDX #spdx Date: Tue, 31 May 2022 22:49:51 -0700 From: Patil, Sandeep via lists.spdx.org <mailto:[email protected]> <[email protected]> Reply-To: [email protected] <mailto:[email protected]> To: [email protected] <mailto:[email protected]> Hi , Is there any roadmap to integrate VEX to with SPDX ? Or is there already way in current SPDX specification to integrate vulnerability information ? Regards Sandeep _____ ⚠ External Email: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#1532): https://lists.spdx.org/g/spdx/message/1532 Mute This Topic: https://lists.spdx.org/mt/91504626/21656 Mute #spdx:https://lists.spdx.org/g/spdx/mutehashtag/spdx Group Owner: [email protected] Unsubscribe: https://lists.spdx.org/g/spdx/leave/2655439/21656/1698928721/xyzzy [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
