Streamlining Vulnerability Management: The Power of VEX Inheritance in Container Ecosystems
summary
Since October 2023 a VEX publishing pipeline outputs CycloneDX VEX for NVIDIA AI Enterprise images on NGC and a parent-image registry plus SBOM diffing reduces repeated triage by inheriting approved VEX when parent and final SBOMs match. The system uses image-layer matching with registry tools like scopio and crane and falls back to build config/dockerfile lineage when compression makes detection unreliable. A November 2024 pilot is live, supports VEX inheritance, maintains global VEX mappings for patched OSS, and still needs owner assignment and more automation.
AI-written summary · about
chapters (12)
- 0:00Vulnerability management in containers
- 1:06NVIDIA’s VEX for containers
- 2:30VEX inheritance and global concepts
- 4:57VEX inheritance workflow steps
- 7:51Global VEX for patched OSS
- 9:38Product catalog and scanning
- 13:09Compliance left with pipeline scanning
- 14:13Parent image detection limits
- 17:44Piloting VEX inheritance lessons
- 19:06Next steps and automation
- 21:58Future AI-driven enhancements
- 22:20Q&A on VEX reuse
related talks
24mEmbracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security
30mTaming the Scanner Storm: How VEX Brings Context to Vulnerability Data
45mVEXing Open Source Security: Vulnerability Data for Everything
33mEnabling VEX and Full SBOM Coverage with Wolfi Based Containers
48m5 Steps to VEX Success: Managing the End-to-End Workflow- 33mEnabling VEX and Full SBOM Coverage with Wolfi Based Containers
33mHow to Generate VEX Automatically for Your Project
47mI Can’t Cope! How OWASP Is Helping To Manage Vulnerability Overload