VEXing Open Source Security: Vulnerability Data for Everything
summary
VEX is a machine-readable Vulnerability Exploitability eXchange that maps specific CVEs to specific package versions and runtime context, includes metadata, product status and remediation suggestions, and is meant to be API-retrievable and paired with a content-addressable s-bomb manifest. Adoption is tiny today — very few vendors ship VEX and CycloneDX adds support — the only public integrator called out is the wasp dependency analyzer. VEX documents are temporal and require vendor or trusted assessor creation.
AI-written summary · about
chapters (12)
- 0:00Start
- 4:23Security Teams' Issues
- 5:18What is VEX?
- 7:52Problems with Software Vulnerability Discovery
- 18:10Scan Differentials
- 19:26What are we going to do about it?
- 23:13What's the perfect solution?
- 26:33VEX Assists Security Teams to toil less
- 30:41Required Fields for VEX
- 32:05Inside a VEX Document
- 32:52Should VEX and SBOM co-exist?
- 37:17Vexatiousness: A Brave New World
related talks
28mWith VEX, The Possibilities are (Almost) Limitless!
47mVEX Overview
31mVEX! or... How to Reduce CVE Noise With One Simple Trick!
50mDemocratizing Exploitability Data with OpenVEX
27mWeaving a VEX Feed Through the Kubernetes Project
45mCSAF/VEX: Improved Security Data
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks