Skip to content

Commit a300e41

Browse files
oaubreyoaubrey
committed
Some product details and vulnerabilities details added
1 parent 564b37a commit a300e41

1 file changed

Lines changed: 192 additions & 12 deletions

File tree

‎docs/vex-alpha-details.md‎

Lines changed: 192 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,28 @@
11
# CSAF-VEX Alpha Details
22

3-
This document is intended to cover the changes made in the new release of Alpha VEX files compared to the legacy VEX files. These changes are broken out by the three main CSAF VEX document sections: Document, Product Tree and Vulnerabilities.
3+
This document is intended to cover the changes made in the new release of alpha VEX files compared to the legacy VEX files. These changes are broken out by the three main CSAF VEX document sections: Document, Product Tree and Vulnerabilities.
44

55
## Document Section
66

77
### Document Changes
88

99
#### Title
10-
Previously, the `document.title` followed the format component:CVE title. The title in the Alpha VEX files removed the component prefix. This decision was made to simplify the title and remove confusion when a CVE affects multiple components.
10+
Previously, the `document.title` followed the format component:CVE title. The title in the alpha VEX files removed the component prefix. This decision was made to simplify the title and remove confusion when a CVE affects multiple components.
1111

1212
```json
1313
# Example of legacy VEX title
1414
"title": "glibc: Integer overflow in memalign leads to heap corruption",
1515
```
1616

1717
```json
18-
# Example of Alpha VEX title
18+
# Example of alpha VEX title
1919
"title": "Integer overflow in memalign leads to heap corruption",
2020
```
2121

2222
#### Tracking
23-
The `document.tracking` object has two changes in the new Alpha VEX files: the generator name has changed and the revision hisotry has been simplified.
23+
The `document.tracking` object has two changes in the new alpha VEX files: the generator name has changed and the revision history has been simplified.
2424

25-
In the new Alpha VEX files, the `document.tracking.generator.engine.name` now references the new service responsible for creating VEX files, "CSAF Generator".
25+
In the new alpha VEX files, the `document.tracking.generator.engine.name` now references the new service responsible for creating VEX files, "CSAF Generator".
2626

2727
```json
2828
# Example of legacy VEX generator
@@ -37,7 +37,7 @@ In the new Alpha VEX files, the `document.tracking.generator.engine.name` now re
3737
```
3838

3939
```json
40-
# Example of Alpha VEX generator
40+
# Example of alpha VEX generator
4141
"generator": {
4242
"date": "2026-02-27T12:07:46+00:00",
4343
"engine": {
@@ -47,7 +47,7 @@ In the new Alpha VEX files, the `document.tracking.generator.engine.name` now re
4747
},
4848
```
4949

50-
The `document.tracking.revision_history` has also been updated in the new Alpha VEX files. Previously, the revision history object implemented some logic to create a history of changes, which was neither accurate nor comprehensive of the historical changes to an individual VEX file. In the new Alpha VEX files, there will only be one revision that represents the last generated version.
50+
The `document.tracking.revision_history` has also been updated in the new alpha VEX files. Previously, the revision history object implemented some logic to create a history of changes, which was neither accurate nor comprehensive of the historical changes to an individual VEX file. In the new alpha VEX files, there will only be one revision that represents the last generated version.
5151

5252
```json
5353
# Example of legacy VEX revision history
@@ -71,7 +71,7 @@ The `document.tracking.revision_history` has also been updated in the new Alpha
7171
```
7272

7373
```json
74-
# Example of Alpha VEX revision history
74+
# Example of alpha VEX revision history
7575
"revision_history": [
7676
{
7777
"date": "2026-02-27T12:07:46+00:00",
@@ -82,8 +82,8 @@ The `document.tracking.revision_history` has also been updated in the new Alpha
8282

8383
```
8484

85-
### Removed Objects
86-
The following optional objects were removed in the Document section and will not be present in the new Alpha VEX files:
85+
### Removed Document Objects
86+
The following optional objects were removed in the document section and will not be present in the new alpha VEX files:
8787

8888
* `document.distribution`
8989
* `document.lang`
@@ -94,22 +94,202 @@ The following optional objects were removed in the Document section and will not
9494
## Product Tree Section
9595

9696
### Branch Removal
97+
In the product tree section of a VEX file, legacy VEX files use to nest `product_name` objects under `product_family` branches and `product_version` objects under `architecture` branches, depending on the fix status of each. The new alpha VEX files remove any branch nesting. All `product_name` and `product_version` objects will only be nested under the parent `vendor` branch.
98+
99+
```json
100+
# Example of legacy VEX branch nesting
101+
"branches": [
102+
{
103+
"branches": [
104+
{
105+
"branches": [
106+
{
107+
"category": "product_name",
108+
"name": "Red Hat Enterprise Linux 8",
109+
"product": {
110+
"name": "Red Hat Enterprise Linux 8",
111+
"product_id": "red_hat_enterprise_linux_8",
112+
"product_identification_helper": {
113+
"cpe": "cpe:/o:redhat:enterprise_linux:8"
114+
}
115+
}
116+
}
117+
],
118+
"category": "product_family",
119+
"name": "Red Hat Enterprise Linux 8"
120+
}
121+
],
122+
"category": "vendor",
123+
"name": "Red Hat"
124+
}
125+
],
126+
```
127+
128+
```json
129+
# Example of alpha VEX branch nesting
130+
"branches": [
131+
{
132+
"category": "vendor",
133+
"name": "Red Hat",
134+
"branches": [
135+
{
136+
"category": "product_name",
137+
"name": "Red Hat Enterprise Linux 8.10.z",
138+
"product": {
139+
"name": "Red Hat Enterprise Linux 8.10.z",
140+
"product_id": "rhel-8.10.z",
141+
"product_identification_helper": {
142+
"cpe": "cpe:/a:redhat:enterprise_linux:8"
143+
}
144+
}
145+
},
146+
]
147+
}
148+
]
149+
```
97150

98151
### Product Changes
152+
The new alpha VEX files include three notable changes to product representation: products are now always represented with a minor version, the product naming convention has been modified for improved consistency and product variants have been eliminated for simplicity.
99153

100154
#### Product Granularity
155+
Previously, legacy VEX files only represented a product with a minor version when a fix was available. New alpha VEX files include representation for any supported minor version, regardless of fix status. This change is intended to provide better affectedness information for each support version of a product that may be impacted by a vulnerability.
101156

102-
#### Product Names
157+
In the example for CVE-2026-0861, the [legacy VEX file](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0861.json) only includes a single `product_name` entry to represent the status of Red Hat Enterprise Linux 8.
158+
159+
```json
160+
# Example of legacy VEX RHEL 8 product representation
161+
{
162+
"category": "product_name",
163+
"name": "Red Hat Enterprise Linux 8",
164+
"product": {
165+
"name": "Red Hat Enterprise Linux 8",
166+
"product_id": "red_hat_enterprise_linux_8",
167+
"product_identification_helper": {
168+
"cpe": "cpe:/o:redhat:enterprise_linux:8"
169+
}
170+
}
171+
}
172+
```
173+
174+
The [alpha VEX file](https://security.access.redhat.com/data/csaf/v2/vex-alpha/2026/cve-2026-0861.json) includes 5 `product_name` entries to represent the status of each supported version of Red Hat Enterprise Linux 8.
175+
176+
```json
177+
# Example of alpha VEX RHEL 8 product representation
178+
{
179+
"category": "product_name",
180+
"name": "Red Hat Enterprise Linux 8.10.z",
181+
"product": {
182+
"name": "Red Hat Enterprise Linux 8.10.z",
183+
"product_id": "rhel-8.10.z",
184+
"product_identification_helper": {
185+
"cpe": "cpe:/a:redhat:enterprise_linux:8"
186+
}
187+
}
188+
},
189+
{
190+
"category": "product_name",
191+
"name": "Red Hat Enterprise Linux 8.2.0.z",
192+
"product": {
193+
"name": "Red Hat Enterprise Linux 8.2.0.z",
194+
"product_id": "rhel-8.2.0.z",
195+
"product_identification_helper": {
196+
"cpe": "cpe:/a:redhat:rhel_aus:8.2"
197+
}
198+
}
199+
},
200+
{
201+
"category": "product_name",
202+
"name": "Red Hat Enterprise Linux 8.4.0.z",
203+
"product": {
204+
"name": "Red Hat Enterprise Linux 8.4.0.z",
205+
"product_id": "rhel-8.4.0.z",
206+
"product_identification_helper": {
207+
"cpe": "cpe:/a:redhat:rhel_eus:8.4"
208+
}
209+
}
210+
},
211+
{
212+
"category": "product_name",
213+
"name": "Red Hat Enterprise Linux 8.6.0.z",
214+
"product": {
215+
"name": "Red Hat Enterprise Linux 8.6.0.z",
216+
"product_id": "rhel-8.6.0.z",
217+
"product_identification_helper": {
218+
"cpe": "cpe:/a:redhat:rhel_eus:8.6"
219+
}
220+
}
221+
},
222+
{
223+
"category": "product_name",
224+
"name": "Red Hat Enterprise Linux 8.8.0.z",
225+
"product": {
226+
"name": "Red Hat Enterprise Linux 8.8.0.z",
227+
"product_id": "rhel-8.8.0.z",
228+
"product_identification_helper": {
229+
"cpe": "cpe:/a:redhat:rhel_eus:8.8"
230+
}
231+
}
232+
},
233+
```
234+
235+
#### Product Naming
236+
237+
```json
238+
# Example of legacy VEX
239+
```
240+
241+
```json
242+
# Example of alpha VEX
243+
```
244+
245+
#### Product Variants
103246

104247
### Component Changes
105248

106-
#### Architectural Changes
249+
#### Architecture Removal
107250

108251
## Vulnerabilities Section
109252

253+
110254
### Remediations
111255

112256
### CVSS Score
257+
The new alpha VEX files simplify the representation of CVSS scores by eliminating the individual metrics, which are still represented in the `vectorString`.
258+
259+
```json
260+
# Example of legacy VEX CVSS scores
261+
"cvss_v3": {
262+
"attackComplexity": "HIGH",
263+
"attackVector": "NETWORK",
264+
"availabilityImpact": "HIGH",
265+
"baseScore": 8.1,
266+
"baseSeverity": "HIGH",
267+
"confidentialityImpact": "HIGH",
268+
"integrityImpact": "HIGH",
269+
"privilegesRequired": "NONE",
270+
"scope": "UNCHANGED",
271+
"userInteraction": "NONE",
272+
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
273+
"version": "3.1"
274+
},
275+
```
276+
277+
```json
278+
# Example of alpha VEX CVSS scores
279+
"cvss_v3": {
280+
"version": "3.1",
281+
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
282+
"baseScore": 8.1,
283+
"baseSeverity": "HIGH"
284+
},
285+
```
286+
287+
### Removed Vulnerabilties Objects
288+
289+
* `vulnerabilities.ids`: Entire object has been removed
290+
* `vulnerabilities.notes`: Note objects of the summary category and the general category have been removed
291+
* `vulnerabilities.references`: References to legacy Bugzilla flaws have been removed from this section
292+
* `vulenrabilities.release_date`: Removed as this date is a duplicate value to `vulnerabilities.discovery_date`
113293

114294
## How to Provide Feedback
115295

0 commit comments

Comments
 (0)