learning from "Open Source Vulnerability format"

[ssst0n3]

https://ossf.github.io/osv-schema/

What, Why, How

[ssst0n3]

Why

There are many problems to solve industry-wide concerning vulnerability detection, tracking, and response. One low-level problem is that there are many databases and no standard interchange format.

• A client that wants to aggregate information from multiple databases must handle each database completely separately.
• Databases that want to exchange information with each other must also each have their own parser for each format.
• Systematic tracking of dependencies and collaboration between vulnerability database efforts is hampered by not having a common interchange format.

What

This document defines a draft of a standard interchange format. We hope to define a format that all vulnerability databases can export, to make it easier for users, security researchers, and any other efforts to consume all available databases. Use of this format would also make it easier for the databases themselves to share or cross-check information.

This shared interchange format is not expected to be the internal format for any particular database. We hope only that every vulnerability database will make its entries available in this format to enable interoperability.

Overall, the approach of this schema is to define only the fields that absolutely must be shared between databases, leaving customizations to the “ecosystem_specific” and “database_specific” blocks (see below)

[ssst0n3]

why

在漏洞检测、跟踪和响应方面，整个行业有许多问题需要解决。一个底层的原因是，数据库之间没有标准的转换格式。

• 一个应用要对每个数据库单独处理
• 希望相互交换信息的数据库也必须为每种格式使用自己的解析器
• 由于没有一个共同的转换格式，系统地跟踪依赖关系和漏洞的数据库之间的合作受到了阻碍

what

这篇文档定义了一个标准的转换格式，通过定义了一种所有漏洞数据库都能输出的格式，使得用户、安全研究人员等更容易使用各数据库。使用这种格式也会使数据库本身更容易分享或交换信息。

这个模式的定义了必须在数据库之间共享的字段，而定制化的信息还是留给了 特定的生态系统和数据库。

具体格式如何定义的，这篇文档给出了详细解释和案例。