#openvex — Public Fediverse posts

OpenVEX в CI/CD: как перестать бороться с ложными CVE и научить Trivy понимать контекст

Представьте: вы пытаетесь объяснить иностранцу, почему красный сигнал светофора не всегда означает «стоять», иногда это — «можно ехать, если ты — скорая помощь». Примерно так до недавнего времени выглядело наше общение с Trivy. Сканер находил уязвимости, DefectDojo их послушно складировал. А мы каждый раз вручную разбирали кучу тикетов, отделяя реальные угрозы от ложных срабатываний. Особенно болезненно это ощущалось во время подготовки релиза, когда каждая минута на счету. Проблема была не в инструментах — они исправно работали и возвращали отчеты о найденных уязвимостях — а в отсутствии «взаимопонимания». Нужно было как-то намекнуть Trivy, что конкретная уязвимость не эксплуатируется в нашем контексте, ее следует пометить как 'not_affected' и больше не отвлекать нас. Таким «мостиком» стал для нас OpenVEX. Меня зовут Роман Корчагин, я занимаюсь процессами безопасной разработки в контейнерной платформе «Штурвал». В статье расскажу, как мы интегрировали генерацию VEX-файлов в пайплайн, и почему разработчики больше не вздрагивают при слове «сканирование».

https://habr.com/ru/companies/chislitellab/articles/1044810/

#openvex #open_source #штурвал #kubernetes #trivy #сканирование #vex #уязвимости #безопасность_контейнеров

🌟 OpenSSF Project Spotlight: #OpenVEX

Adolfo Veytia walks us through how OpenVEX helps developers clearly communicate which vulnerabilities actually impact their software - and which don’t.

https://youtu.be/dGOiWFNKKpM?si=SJIpCxmHStRvT4Ml

🌟 OpenSSF Project Spotlight: #OpenVEX

Adolfo Veytia walks us through how OpenVEX helps developers clearly communicate which vulnerabilities actually impact their software - and which don’t.

https://youtu.be/dGOiWFNKKpM?si=SJIpCxmHStRvT4Ml

One Open-source Project Daily

A vulnerability scanner for container

https://github.com/anchore/grype

#1ospd #opensource #docker #golang #security #tool #containers #oci #vulnerability #vex #vulnerabilities #containerimage #cyclonedx #openvex

One Open-source Project Daily

A vulnerability scanner for container

https://github.com/anchore/grype

#1ospd #opensource #docker #golang #security #tool #containers #oci #vulnerability #vex #vulnerabilities #containerimage #cyclonedx #openvex

I'm about to present how to generate #OpenVEX data from #SBOM the hard and the easy way at #OSSummit. There will be fast cars, car crashes and lots of bad stock photos!

Come and have fun with me and @wolfi at 3:55 pm, room 0C.

I'm about to present how to generate #OpenVEX data from #SBOM the hard and the easy way at #OSSummit. There will be fast cars, car crashes and lots of bad stock photos!

Come and have fun with me and @wolfi at 3:55 pm, room 0C.

SBOM alone may not encode enough detail to separate non-exploitable vulnerabilities from exploitable ones writes Surendra Pathak in our latest guest blog on #VDR, #VEX, #OpenVEX and #CSAF https://openssf.org/blog/2023/09/07/vdr-vex-openvex-and-csaf/

SBOM alone may not encode enough detail to separate non-exploitable vulnerabilities from exploitable ones writes Surendra Pathak in our latest guest blog on #VDR, #VEX, #OpenVEX and #CSAF https://openssf.org/blog/2023/09/07/vdr-vex-openvex-and-csaf/

At the heart of the CVE process and the matching done with the NVD database is the name of the manufacturer and the artefact - the software, system, library or mobile application. It's vital for this to work that the name in the #SBOM is correct to make the match work. The community has developed #PURL - package URL - to improve but so far the CVE/NVD eco system has not adopted PURL.

This needs to be fixed to make sure that the name in the SBOM matches the right set of vulnerabilities.

#SBOM #securesupplychain #CycloneDX #OpenVEX #VEX #OpenSource

At the heart of the CVE process and the matching done with the NVD database is the name of the manufacturer and the artefact - the software, system, library or mobile application. It's vital for this to work that the name in the #SBOM is correct to make the match work. The community has developed #PURL - package URL - to improve but so far the CVE/NVD eco system has not adopted PURL.

This needs to be fixed to make sure that the name in the SBOM matches the right set of vulnerabilities.

#SBOM #securesupplychain #CycloneDX #OpenVEX #VEX #OpenSource

I published a .NET library for #OpenVEX!

NuGet: https://www.nuget.org/packages/OpenVEX/
GitHub: https://github.com/JamieMagee/openvex.net

I published a .NET library for #OpenVEX!

NuGet: https://www.nuget.org/packages/OpenVEX/
GitHub: https://github.com/JamieMagee/openvex.net

Playing with #ActivityPub as a way to do notifications for new #VEX, and hoping to piggyback decentralized CD over that as comms channel. Very rough draft here RFCv5: https://github.com/ietf-scitt/use-cases/blob/3f10017af4cebb7d07e541c299ef277d43fb9c0d/openssf_metrics.md#use-case-attestations-of-alignment-to-s2c2f-and-org-overlays

#OpenVEX #Fediverse #supplychain #security

Comments appreciated!

https://github.com/intel/dffml/discussions/1406?sort=new#discussioncomment-4863663

Playing with #ActivityPub as a way to do notifications for new #VEX, and hoping to piggyback decentralized CD over that as comms channel. Very rough draft here RFCv5: https://github.com/ietf-scitt/use-cases/blob/3f10017af4cebb7d07e541c299ef277d43fb9c0d/openssf_metrics.md#use-case-attestations-of-alignment-to-s2c2f-and-org-overlays

#OpenVEX #Fediverse #supplychain #security

Comments appreciated!

https://github.com/intel/dffml/discussions/1406?sort=new#discussioncomment-4863663