CRAVEX: Export VEX document: CSAF

[pombredanne]

Export the results of the vulnerabilities triage and processing as CSAF VEX document

[DennisClark]

Looking for current example CSAF files with actual data and for a definitive version of the current specfification.

Also, for reference see
https://github.com/oasis-tcs/csaf and
https://www.redhat.com/en/blog/common-security-advisory-framework-csaf-beta-files-now-available (2022-06-17).

[DennisClark]

Specific public examples of CSAF 2.0 documents from Schneider Electric can be found here:
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp

One example is attached.

sevd-2023-101-05.json

[pombredanne]

I am not sure this requires mucho design, does it? Based on what we have for CycloneDX this should be easy.

[tdruez]

Documentation

• SPEC https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html
• Schema 2.0 https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/json_schema/csaf_json_schema.json
• Tools listing https://oasis-open.github.io/csaf-documentation/tools.html
• FAQ https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/guidance/faq.md#what-is-vex-and-how-is-it-supported-in-csaf
• Examples https://github.com/oasis-tcs/csaf/tree/master/csaf_2.0/examples/csaf

Tools

• Python lib https://github.com/anthonyharrison/csaf
• CSAF Viewer/Editor https://secvisogram.github.io/

VEX use cases

• https://www.cisa.gov/sites/default/files/publications/VEX_Use_Cases_Aprill2022.pdf

A VEX document is a form of a security advisory that indicates whether a
product or products are affected by a known vulnerability or vulnerabilities.

The goal of Vulnerability Exploitability eXchange (VEX) is to allow a software supplier or other
parties to assert the status of specific vulnerabilities in a particular product.

The OASIS Common Security Advisory Framework (CSAF) defines ‘product’ as “any deliverable (e.g., software,
hardware, specification, …) which can be referred to with a name.

This document covers many variations of VEX use cases:

• Single Product, Single Vulnerability: CSAF VEX vs CycloneDX VEX
• Single Product, Multiple Vulnerabilities: CSAF VEX vs CycloneDX VEX
• Multiple Products, Single Vulnerability
• Multiple Products, Multiple Vulnerabilities