-
`csaf.ValidateCSAF()` doesn't validate against mandatory additional fields for specific CSAF profiles other than `csaf_base` (as described in: https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-o…
-
I noticed a massive drop in performance when running the CSAF import process. I don't have numbers yet, but I'll investigate.
In the SQL logs I noticed at of a "select then insert" patters again.
ctron updated
2 months ago
-
```[tasklist]
### Tasks
- [x] Create Github Action to publish a CSAF document for specific vulnerabilities
- [x] Sign and hash CSAF documents
- [x] Add legal disclaimer to CSAF documents
- [x] Ad…
-
We should add a special profile that is used for withdrawn CSAF documents.
Reasoning: Sometimes, it is necessary to withdraw a document. Currently, those documents are mostly set into the document …
-
Hi guys, this is not to report a bug but more a way of asking a question.
Context:
- I upload the sbom [quarkus-bom-3.2.11.Final-redhat-00001.json](https://github.com/user-attachments/files/16562…
-
reported by @mjherzog
We should add data in CSAF format from https://github.com/cisagov/CSAF
Note:
- there may be several devices we may not care for in these data
- https://github.com/oas…
-
**Scenario 1:** A CSAF VEX advisory can provide the status of one vulnerability in one product, as shown below:
![image](https://github.com/user-attachments/assets/cbc307ea-1c39-415d-926e-8eac6866561…
-
As discussed in today's TC meeting, we should define the vendor. Here is the definition of CSAF as a starting point:
_**vendor**: the community, individual, or organization that created or maintain…
-
### Current Behavior
Some commercial software vendors provide advisory information in CSAF 2.0 format. These include RedHat and Oracle, among others. There isn't currently a good way to identify vu…
-
- I ran the red hat sbom importers + the csaf importers for at least 5 minutes
- The I hit `GET /api/v1/package/b11f922a-6ab3-553f-b703-6fc65d0f1fe9` which corresponds to the package whose purl is `p…