With VEX, The Possibilities are (Almost) Limitless!
summary
A vex-reader Python library parses CEF VEX and powers a lightweight Flask site that recreates CVE pages from VEX plus NVD, CVE.org and EPSS, and it outputs a Hugging Face dataset that can be queried with DuckDB. The work demonstrates converting VEX into usable tooling, surfaces a scanner reporting >600 false positives on an up-to-date VM, reveals ISO date handling bugs with SUSE VEX on Python 3.9, and exposes vendor inconsistencies and adoption gaps.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:07VEX rise and importance
- 3:55Adopting VEX challenges
- 6:20Building a VEX reader
- 8:26Reproducing CVE pages
- 10:33VEX for AI and analytics
- 13:02VEX vendor compatibility
- 15:49Industry feedback on VEX
- 17:53VEX data possibilities
- 19:37Q&A: VEX for vulnerability management
- 21:44Q&A: VEX vs SBOM
- 23:12Q&A: VEX vendor role
- 25:18Q&A: Extending VEX attributes
- 26:00Q&A: Open source VEX burden
- 28:00Closing remarks
related talks
45mVEXing Open Source Security: Vulnerability Data for Everything
30mTaming the Scanner Storm: How VEX Brings Context to Vulnerability Data
45mCSAF/VEX: Improved Security Data
48m5 Steps to VEX Success: Managing the End-to-End Workflow
31mVEX! or... How to Reduce CVE Noise With One Simple Trick!
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
50mDemocratizing Exploitability Data with OpenVEX
47mVEX Overview