epugh opened a new pull request, #204:
URL: https://github.com/apache/solr-site/pull/204
OpenVex is another standard for communicating VEX statements. The big
difference between it and CycloneDX format is that OpenVEX requires a _purl_
identifier for each version of Solr. You can't just do a range.
For example, CVE-2012-0881 impacts from after 2.9 up to 9.10. We document
it as `versions: "2.9-9.10"`.
This expands that range to list each one out in the actual openvex file that
you download:
```
"statements": [
{
"vulnerability": {
"name": "CVE-2012-0881"
},
"products": [
{
"@id": "pkg:maven/org.apache.solr/[email protected]",
"subcomponents": [
{
"@id": "pkg:maven/xerces/[email protected]"
}
]
},
{
"@id": "pkg:maven/org.apache.solr/[email protected]",
"subcomponents": [
{
"@id": "pkg:maven/xerces/[email protected]"
}
]
},
BLAH BLAH BLAH.....
```
This lets us keep our concise version information, but meet the OpenVEX
standard. Since some of our vex files don't have a lower bound of Solr, only
an upper, then they get skipped so we don't list all the way back to 1.0! I
will in a separate PR investigate existing vex statements to idenfity when the
vulnerablity was introduced into solr.
Hopefully this also lets us control better the narrative of what
vulnerablities are out there that impact Solr by making these statements
machine readable. This way, as we make fixes etc, we can update our VEX
statements and direct people to them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
