Vulnerability Exploitability eXchange (VEX)

 

Vulnerability Exploitability eXchange (VEX) is a form of a security advisory where the goal is to communicate the exploitability of components with known vulnerabilities in the context of the product in which they are used. Often times, products are not affected by a vulnerability simply by including an otherwise vulnerable component. VEX allows software vendors and other parties to communicate the exploitability status of vulnerabilities, providing clarity on the vulnerabilities that pose risk and the ones that do not.

VEX is a critical capability necessary to operationalize SBOM.

• VEX information can be represented inside an existing BOM, or in a dedicated VEX BOM
• Communicates the vulnerability details, exploitability, and detailed analysis
• Informs software consumers on actions the vendor has taken, or which the consumer must take, to reduce risk

Independent BOM and VEX BOM

Inventory described in a BOM (SBOM, SaaSBOM, etc) will typically remain static until such time the inventory changes. However, vulnerability information is much more dynamic and subject to change. Therefore, it is recommended to decouple the VEX from the BOM. This allows VEX information to be updated without having to create and track additional BOMs.

VEX is an integral part of the CycloneDX specification providing the convenience of leveraging a single format and tool chain.

With CycloneDX, it is possible to reference a component, service, or vulnerability inside a BOM from other systems or other BOMs. This deep-linking capability is referred to as BOM-Link and is a formally registered URN.

Learn more about how CycloneDX makes use of BOM-Link.

CycloneDX VEX BOMs can also be used with alternative SBOM formats such as SPDX, but without the tight integration or support of an IETF standard for linkage. Vendor support may vary.

BOM With Embedded VEX

CycloneDX also supports embedding VEX information inside a BOM, thus having a single artifact that describes both inventory and VEX data. There are several uses for embedding VEX data including:

• Audit use cases where inventory and vulnerability data need to be captured at a specific point in time
• Automated security tools may opt to create a single BOM with embedded vulnerability or VEX data for convenience and portability

CycloneDX and Third-Party Advisory Formats

Every component or service defined in a CycloneDX BOM may optionally define external references to security advisory feeds. CycloneDX is agnostic to the advisory format, however, the Common Security Advisory Framework (CSAF), an OASIS Open standard, is recommended. Refer to the Security Advisories Use Case for more information.

CSAF also supports an optional VEX profile which can be used with CycloneDX.

High-Level Object Model

Examples

BOMs demonstrating VEX capabilities can be found at https://github.com/CycloneDX/bom-examples

Additional Capabilities