CSAF/VEX: Improved Security Data
summary
Red Hat publishes advisories and VEX files where advisories point to fixed artifacts and VEX (grouped by CVE) asserts whether each product/component is affected, fixed or under investigation; VEX entries link to the vendor SBOMs and use CPE 2.2 for products and PURL for components. A Red Hat Vulnerability Scanner Exchange onboards scanners, the archive of CSAF/VEX back to 2002 is available (≈150 MB compressed), and practical problems remain: expressing product version ranges, support/EoL status (see OpenEoX) and whether to publish huge numbers of “not affected” assertions.
AI-written summary · about
chapters (14)
- 0:00CSAF/VEX and CF format intro
- 3:15CSAF advisory and VEX structure
- 9:17VEX, SBOMs, and advisories connection
- 11:27Red Hat’s VEX data program
- 11:49VEX in secure development
- 14:22VEX to product support mapping
- 16:52Open EOL for lifecycle data
- 17:12Challenges in VEX data capture
- 23:55Will not fix CVEs handling
- 25:25Effectiveness in VEX
- 29:11Q&A: VEX granularity and tooling
- 33:07Q&A: Product vs component analysis
- 37:07Q&A: Customer deployments
- 44:08Closing remarks
related talks
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
47mVEX Overview
45mVEXing Open Source Security: Vulnerability Data for Everything
46mThree Musketeers: CVE, CSAF, and VEX
39mCSAF - the Magic Potion for Vulnerability Handling in Industrial Environments
31mVEX! or... How to Reduce CVE Noise With One Simple Trick!
30mTaming the Scanner Storm: How VEX Brings Context to Vulnerability Data
37mVEXed by Vulnerabilities That Don't Affect Your Product? Try This!