docs(security): add VEX file with vulnerabilities information to SBOM

[dfucci]

Dear project owners,
We are a group of researchers investigating the usefulness of augmenting Software Bills of Materials (SBOMs) with information about known vulnerabilities of third-party dependencies.

As claimed in previous interview-based studies, a major limitation—according to software practitioners—of existing SBOMs is the lack of information about known vulnerabilities. For this reason, we would like to investigate how augmented SBOMs are received in open-source projects.

To this aim, we have identified popular open-source repositories on GitHub that provided SBOMs, statically detected vulnerabilities on their dependencies in the OSV database, and, based on its output, we have augmented your repository’s SBOM by leveraging the OpenVEX implementation of the Vulnerability Exploitability eXchange (VEX).

The JSON file in this pull request consists of statements each indicating i) the software products (i.e., dependencies) that may be affected by a vulnerability. These are linked to the SBOM components through the @id field in their Persistent uniform resource locator (pURL); ii) a CVE affecting the product; iii) an impact status defined by VEX. By default, all statements have status under_investigation as it is not yet known whether these product versions are actually affected by the vulnerability. After investigating the vulnerability, further statuses can be affected, not_affected, fixed. It is possible to motivate the new status in a justification field (see https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf for more information).

We open this pull request containing a VEX file related to the SBOM of your project, and hope it will be considered.
We would also like to hear your opinion on the usefulness (or not) of this information by answering a 3-minute anonymous survey:
https://ww2.unipark.de/uc/sbom/

Thanks in advance, and regards,
Davide Fucci (Blekinge Institute of Technology, Sweden)
Simone Romano and Giuseppe Scaniello (University of Salerno, Italy),
Massimiliano Di Penta (University of Sannio, Italy)

[terriko]

We already have a vex file here: https://github.com/intel/cve-bin-tool/blob/main/TRIAGE.json

Is there some particular reason you'd want to make a second one with less info in it, or was this pull request generated by a script that missed where the actual one was kept?

[terriko]

Also, if you have any recommendations on how to make it more obvious to people or scripts that we do in fact have a vex file already, I'd love some feedback on that.

[terriko]

I'm pretty sure the correct path here would be to integrate anything we've missed into the existing triage json file, so I'm marking this as needing changes and won't bother letting it run through CI at this time.

[dfucci]

We already have a vex file here: https://github.com/intel/cve-bin-tool/blob/main/TRIAGE.json

Is there some particular reason you'd want to make a second one with less info in it, or was this pull request generated by a script that missed where the actual one was kept?

Thanks for your comment @terriko
This pull request was generated after our script found this repository containing SBOM.
Unfortunately, we missed the VEX file.

[dfucci]

Also, if you have any recommendations on how to make it more obvious to people or scripts that we do in fact have a vex file already, I'd love some feedback on that.

AFAIK, there is no accepted way of doing this. We decided to have an ad-hoc VEX for each SBOM following a naming convention (file.spdx -> file.vex.json).
This would help us to decouple dependencies tracked in an SBOM from their vulnerabilities info, which may be used for a specific use case (risk assessment).

[dfucci]

I'm pretty sure the correct path here would be to integrate anything we've missed into the existing triage json file, so I'm marking this as needing changes and won't bother letting it run through CI at this time.

Please notice that our VEX includes CVEs which are not present in yours.
I am not sure if they have been addressed already (I did not check the history of your VEX), but our VEX was generated on Oct 16, right before opening this PR.

[terriko]

Had a bit of time to do an actual look through the difference in the findings. Looks two of them are already resolved since your script ran, but two of them point to places we could maybe recommend higher minimums, so thank you for that! If you'd like to make a PR for changes to requirements.txt feel free, otherwise I'll leave this open so I don't forget, but we can probably close this PR specifically after that.

And yeah, I'm still waiting for some standards to emerge around vex locations. we went with TRIAGE.json to match README.md and SECURITY.md and the like, but it might be more reasonable to stick it into the directory with the individual sboms (just more of a pain because we generate sboms per-python so then I get stuck maintaining a lot mroe of them). I'll have to think about it and maybe bug the others for ideas during our end of october monthly meeting.

[terriko]

requirements.txt currently says aiohttp[speedups]>=3.9.4 so we may want to bump the minimum here. I'd rather do that than maintain a vex for this one.

[terriko]

requirements.txt currently says zipp>=3.19.1 so we may want to bump the range up.

[terriko]

Requirements currently says requests>=2.32.2 so this is likely not relevant.

[terriko]

requirements.txt says urllib3>=2.2.2 so I don't think this is currently relevant.

[terriko]

We don't curently require certifi directly so I'll have to double-check which dependency this is coming from and whether they have it pinned, but we may be able to recommend a min version for people like we do with some of our other tertiary dependencies with known vulnerabilities. (@anthonyharrison do you know off the top of your head? I know you generate the dependency trees sometimes.)