OpenVEX Products and Subcomponents: purl Matching Rules
An OpenVEX statement suppresses a finding only when its products, subcomponents and purls line up with what the scanner found. Here is how the go-vex …
Tag
Sbom
CVE packageURL: Join CVE JSON 5.2 Records to SBOM purls
CVE Record Format 5.2.0 added an optional packageURL field to affected entries. We counted it across all 400,445 published records: 1.6% carry one, 12 …
CSAF VEX product_tree: Resolve Product IDs to SBOM purls
A CSAF VEX file never puts a purl next to a status. Product IDs in product_status point into the product_tree, often through relationships. Here is …
CycloneDX VEX: analysis.state and justification to OpenVEX
CycloneDX VEX uses six analysis states and nine justifications; OpenVEX and CSAF use four statuses and five justifications. Here is a field-by-field …
CVE Affected Versions: lessThan, defaultStatus, versionType
The affected block in a CVE record is a small algorithm, not a list. Here is how version, lessThan, lessThanOrEqual, changes, versionType and …