search

intel / cve-bin-tool

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 200 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.
https://cve-bin-tool.readthedocs.io/en/latest/
GNU General Public License v3.0
1.24k stars 464 forks source link

docs(security): add VEX file with vulnerabilities information to SBOM #4511

Open dfucci opened 1 month ago

dfucci commented 1 month ago

Dear project owners, We are a group of researchers investigating the usefulness of augmenting Software Bills of Materials (SBOMs) with information about known vulnerabilities of third-party dependencies.

As claimed in previous interview-based studies, a major limitation—according to software practitioners—of existing SBOMs is the lack of information about known vulnerabilities. For this reason, we would like to investigate how augmented SBOMs are received in open-source projects.

To this aim, we have identified popular open-source repositories on GitHub that provided SBOMs, statically detected vulnerabilities on their dependencies in the OSV database, and, based on its output, we have augmented your repository’s SBOM by leveraging the OpenVEX implementation of the Vulnerability Exploitability eXchange (VEX).

The JSON file in this pull request consists of statements each indicating i) the software products (i.e., dependencies) that may be affected by a vulnerability. These are linked to the SBOM components through the @id field in their Persistent uniform resource locator (pURL); ii) a CVE affecting the product; iii) an impact status defined by VEX. By default, all statements have status under_investigation as it is not yet known whether these product versions are actually affected by the vulnerability. After investigating the vulnerability, further statuses can be affected, not_affected, fixed. It is possible to motivate the new status in a justification field (see https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf for more information).

We open this pull request containing a VEX file related to the SBOM of your project, and hope it will be considered. We would also like to hear your opinion on the usefulness (or not) of this information by answering a 3-minute anonymous survey: https://ww2.unipark.de/uc/sbom/

Thanks in advance, and regards, Davide Fucci (Blekinge Institute of Technology, Sweden) Simone Romano and Giuseppe Scaniello (University of Salerno, Italy), Massimiliano Di Penta (University of Sannio, Italy)

terriko commented 1 month ago

We already have a vex file here: https://github.com/intel/cve-bin-tool/blob/main/TRIAGE.json

Is there some particular reason you'd want to make a second one with less info in it, or was this pull request generated by a script that missed where the actual one was kept?

terriko commented 1 month ago

Also, if you have any recommendations on how to make it more obvious to people or scripts that we do in fact have a vex file already, I'd love some feedback on that.

dfucci commented 1 month ago

We already have a vex file here: https://github.com/intel/cve-bin-tool/blob/main/TRIAGE.json

Is there some particular reason you'd want to make a second one with less info in it, or was this pull request generated by a script that missed where the actual one was kept?

Thanks for your comment @terriko
This pull request was generated after our script found this repository containing SBOM. Unfortunately, we missed the VEX file.

dfucci commented 1 month ago

Also, if you have any recommendations on how to make it more obvious to people or scripts that we do in fact have a vex file already, I'd love some feedback on that.

AFAIK, there is no accepted way of doing this. We decided to have an ad-hoc VEX for each SBOM following a naming convention (file.spdx -> file.vex.json). This would help us to decouple dependencies tracked in an SBOM from their vulnerabilities info, which may be used for a specific use case (risk assessment).

dfucci commented 1 month ago

I'm pretty sure the correct path here would be to integrate anything we've missed into the existing triage json file, so I'm marking this as needing changes and won't bother letting it run through CI at this time.

Please notice that our VEX includes CVEs which are not present in yours. I am not sure if they have been addressed already (I did not check the history of your VEX), but our VEX was generated on Oct 16, right before opening this PR.

dfucci commented 1 month ago

Looks two of them are already resolved since your script ran, but two of them point to places we could maybe recommend higher minimums, so thank you for that!

Glad we could help.

I will leave this PR open for you as a reminder.