|
1 | 1 | # CSAF-VEX Alpha Details |
2 | 2 |
|
3 | | -This document is intended to cover the changes made in the new release of Alpha VEX files compared to the legacy VEX files. |
| 3 | +This document is intended to cover the changes made in the new release of Alpha VEX files compared to the legacy VEX files. These changes are broken out by the three main CSAF VEX document sections: Document, Product Tree and Vulnerabilities. |
4 | 4 |
|
5 | | -## Document Changes |
| 5 | +## Document Section |
6 | 6 |
|
7 | | -## Product Tree Changes |
| 7 | +### Document Changes |
8 | 8 |
|
9 | | -## Vulnerabilities Changes |
| 9 | +#### Title |
| 10 | +Previously, the `document.title` followed the format component:CVE title. The title in the Alpha VEX files removed the component prefix. This decision was made to simplify the title and remove confusion when a CVE affects multiple components. |
| 11 | + |
| 12 | +```json |
| 13 | +# Example of legacy VEX title |
| 14 | +"title": "glibc: Integer overflow in memalign leads to heap corruption", |
| 15 | +``` |
| 16 | + |
| 17 | +```json |
| 18 | +# Example of Alpha VEX title |
| 19 | +"title": "Integer overflow in memalign leads to heap corruption", |
| 20 | +``` |
| 21 | + |
| 22 | +#### Tracking |
| 23 | +The `document.tracking` object has two changes in the new Alpha VEX files: the generator name has changed and the revision hisotry has been simplified. |
| 24 | + |
| 25 | +In the new Alpha VEX files, the `document.tracking.generator.engine.name` now references the new service responsible for creating VEX files, "CSAF Generator". |
| 26 | + |
| 27 | +```json |
| 28 | +# Example of legacy VEX generator |
| 29 | +"generator": { |
| 30 | + "date": "2026-02-24T17:08:13+00:00", |
| 31 | + "engine": { |
| 32 | + "name": "Red Hat SDEngine", |
| 33 | + "version": "4.7.1" |
| 34 | + } |
| 35 | +}, |
| 36 | + |
| 37 | +``` |
| 38 | + |
| 39 | +```json |
| 40 | +# Example of Alpha VEX generator |
| 41 | +"generator": { |
| 42 | + "date": "2026-02-27T12:07:46+00:00", |
| 43 | + "engine": { |
| 44 | + "name": "CSAF Generator", |
| 45 | + "version": "1.0.3" |
| 46 | + } |
| 47 | +}, |
| 48 | +``` |
| 49 | + |
| 50 | +The `document.tracking.revision_history` has also been updated in the new Alpha VEX files. Previously, the revision history object implemented some logic to create a history of changes, which was neither accurate nor comprehensive of the historical changes to an individual VEX file. In the new Alpha VEX files, there will only be one revision that represents the last generated version. |
| 51 | + |
| 52 | +```json |
| 53 | +# Example of legacy VEX revision history |
| 54 | +"revision_history": [ |
| 55 | + { |
| 56 | + "date": "2026-01-14T21:01:11.037000+00:00", |
| 57 | + "number": "1", |
| 58 | + "summary": "Initial version" |
| 59 | + }, |
| 60 | + { |
| 61 | + "date": "2026-02-10T16:17:28+00:00", |
| 62 | + "number": "2", |
| 63 | + "summary": "Current version" |
| 64 | + }, |
| 65 | + { |
| 66 | + "date": "2026-02-24T17:08:13+00:00", |
| 67 | + "number": "3", |
| 68 | + "summary": "Last generated version" |
| 69 | + } |
| 70 | +], |
| 71 | +``` |
| 72 | + |
| 73 | +```json |
| 74 | +# Example of Alpha VEX revision history |
| 75 | +"revision_history": [ |
| 76 | + { |
| 77 | + "date": "2026-02-27T12:07:46+00:00", |
| 78 | + "number": "1", |
| 79 | + "summary": "Last generated version" |
| 80 | + } |
| 81 | +], |
| 82 | + |
| 83 | +``` |
| 84 | + |
| 85 | +### Removed Objects |
| 86 | +The following optional objects were removed in the Document section and will not be present in the new Alpha VEX files: |
| 87 | + |
| 88 | +* `document.distribution` |
| 89 | +* `document.lang` |
| 90 | +* `document.notes` |
| 91 | +* `document.references` |
| 92 | + |
| 93 | + |
| 94 | +## Product Tree Section |
| 95 | + |
| 96 | +### Branch Removal |
| 97 | + |
| 98 | +### Product Changes |
| 99 | + |
| 100 | +#### Product Granularity |
| 101 | + |
| 102 | +#### Product Names |
| 103 | + |
| 104 | +### Component Changes |
| 105 | + |
| 106 | +#### Architectural Changes |
| 107 | + |
| 108 | +## Vulnerabilities Section |
| 109 | + |
| 110 | +### Remediations |
| 111 | + |
| 112 | +### CVSS Score |
10 | 113 |
|
11 | 114 | ## How to Provide Feedback |
12 | 115 |
|
|
0 commit comments