What's New in CSAF and OpenEoX
summary
CSAF moves toward a 2.1 community draft that adds CSAF 2.1 schema changes: publisher object with multiple categories, plural CWE entries, discovery/disclosure date fields, and generalized metrics support beyond CVSS to include SSVC; discovery becomes machine‑readable via well‑known discovery & Rolley; product IDs intentionally reference SBOMs (CycloneDX/SPDX) and VEX pointers rather than reinventing identifiers. OpenEoX builds a taxonomy for EOL/EOS, publishes a lightweight schema, runs workshops, and leverages existing open‑source tools from BSI/CISA and vendors to drive adoption (drafts and tooling are in active use but not final).
AI-written summary · about
chapters (7)
- 0:00CSAF and OpenEoX intro
- 3:58CSAF evolution to current
- 8:10CSAF 2.1 schema enhancements
- 13:28CSAF 2.1 adoption efforts
- 17:27OpenEoX standardization motivation
- 20:25OpenEoX taxonomy and definitions
- 22:54Q&A
related talks
25mCSAF 2.0 - A New Start to Automate Advisories
39mCSAF - the Magic Potion for Vulnerability Handling in Industrial Environments
46mThree Musketeers: CVE, CSAF, and VEX
31mOpen Source SCA
48mElevating Security Standards: Intel's Integration of Common Security Advisory Framework into ...
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
45mCSAF/VEX: Improved Security Data
41mPlanning for Retirement: How Can We Prepare for Software’s...