VEX Overview
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Friday, 2022-06-24· at 12:00· Brazos (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
VEX is a machine‑readable binding that pairs a vulnerability identifier with a specific product and a status such as affected/not affected/fixed/under consideration, encoded as a CSAF profile and interoperable with CycloneDX and SBOMs. Implementations already appear in ICS and medical device workflows and some vendors sell VEX attestations. Status justification codes detail why something is safe—examples include components not present and vulnerable code not present. CISA hosts schemas and will publish the justification code list on the CSAF GitHub.
AI-written summary · about
chapters (12)
- 0:00Start
- 2:27Challenges of Security Advisories
- 4:54Not all Vulnerabilities Are Exploitable
- 5:15Security Advisories
- 9:40Product
- 11:17Types of Security Advisories
- 11:45Common Security Advisory Framework
- 17:56Status Justifications
- 22:05Logging Bugs
- 22:44Other Mitigations
- 24:35The Csaf Model
- 42:44Product Identifier
related talks
37mVEXed by Vulnerabilities That Don't Affect Your Product? Try This!
45mVEXing Open Source Security: Vulnerability Data for Everything
45mCSAF/VEX: Improved Security Data
31mVEX! or... How to Reduce CVE Noise With One Simple Trick!
46mThree Musketeers: CVE, CSAF, and VEX
48m5 Steps to VEX Success: Managing the End-to-End Workflow
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
39mCSAF - the Magic Potion for Vulnerability Handling in Industrial Environments