Implementing Minimum Requirements for VEX

The Software Bill of Materials (SBOM) gets stymied by SBOM quality and vulnerability-specific noises. CISA has recommended creating VEX information with Minimum Requirements for Vulnerability Exploitability eXchange to tackle the latter.

The VEX Minimum Requirements document recommends including fields in the VEX embedded in an SBOM or as a stand-alone document.

In an earlier post, we focused on detailing where CycloneDX VEX, OpenVEX, and CSAF stand in relation to the vulnerability disclosure.

In this post, we breakdown the field mappings of Minimum Requirements to CycloneDX VEX and OpenVEX.