Three Musketeers: CVE, CSAF, and VEX
summary
CISA and partner teams build a custom platform that ingests vendor reports, uses Vulnogram and SecVizigram prototypes for validation, and outputs paired CVE records plus CSAF advisories with signatures, ROLIE updates and GitHub publication. The tool maps product naming and versions via VERS, translates statuses between CVE and CSAF vocabularies, produces CVSS 3.1/4.0 and SSVC 2.0 (SSVC added as a note), and emits CSAF VEX statements via the CSAF VEX profile; automation works but publishing race conditions and data quality gaps remain.
AI-written summary · about
chapters (12)
- 0:00CVE, CSAF, and VEX intro
- 3:14CVD process and risk management
- 7:09Why CISA chose CVE/CSAF
- 10:19High-quality vulnerability records
- 15:23Product naming and versioning
- 18:09Writing CVE descriptions
- 20:58CVSS and SSVC scoring
- 25:36CSAF references and disclosure
- 28:52Data quality in vulnerability records
- 32:02Efficient CSAF/CVE publishing
- 36:14Semantic mapping challenges
- 39:05Q&A and CSAF 2.1 future
related talks
45mCSAF/VEX: Improved Security Data
39mCSAF - the Magic Potion for Vulnerability Handling in Industrial Environments
47mVEX Overview
48mElevating Security Standards: Intel's Integration of Common Security Advisory Framework into ...
48m5 Steps to VEX Success: Managing the End-to-End Workflow
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
25mCSAF 2.0 - A New Start to Automate Advisories
45mVEXing Open Source Security: Vulnerability Data for Everything