search

l3montree-dev / devguard

DevGuard Backend - Manage your CVEs seamlessly, Integrate your Vulnerability Scanners, Security Framework Documentation made easy, Compliance to security Frameworks - OWASP Incubating Project
https://devguard.org
Other
41 stars 5 forks source link

It should be possible to download VEX Information #68

Open timbastin opened 7 months ago

timbastin commented 7 months ago

VEX provides critical insights into the exploitability of vulnerabilities in software components, enabling users to prioritize remediation efforts effectively.

Why is this important?

  1. Efficiency: Incorporating VEX download capability streamlines the process of assessing the exploitability of vulnerabilities, saving users time by focusing on impactful issues. Automation and Integration: VEX data being machine-readable facilitates automation and seamless integration into broader security tooling and processes. 2.Enhanced Security Posture: Direct access to VEX information empowers users to adopt a more informed approach to securing their software, prioritizing remediation efforts effectively.

Feature Request

Implement a feature to enable the downloading of VEX information within software analysis tools, either as part of software bill of materials (SBOM) analysis or as a standalone feature. Ensure the feature supports parsing and presenting VEX data in a user-friendly format, facilitating easy comprehension of vulnerability status (e.g., Not Affected, Affected, Fixed, Under Investigation). Consider leveraging the Common Security Advisory Framework (CSAF) for implementation, as VEX is integrated as a profile within CSAF, ensuring compatibility and adherence to industry standards.

https://www.ntia.gov/files/ntia/publications/vex_one-page_summary.pdf