rjb4standards/REA-Products

SBOM VDR

tschmidtb51 opened this issue · 5 comments

tschmidtb51 commented

Hi @rjb4standards,
here is rough draft, how an SBOM VDR could look like in CSAF:

{
  "document": {
    "category": "sbom_vdr",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "name": "Reliable Energy Analytics",
      "namespace": "https://reliableenergyanalytics.com"
    },
    "title": "SBOM VDR on PowerToys (Preview)",
    "tracking": {
      "current_release_date": "2022-01-12T20:17:38.464608+00:00",
      "id": "SBOM-VDR-2022-0001",
      "initial_release_date": "2022-01-12T20:17:38.464608+00:00",
      "revision_history": [
        {
          "date": "2022-01-12T20:17:38.464608+00:00",
          "number": "1",
          "summary": "Initial version."
        }
      ],
      "status": "final",
      "version": "1",
      "generator": {
        "date": "2022-03-24T15:42:17.598Z",
        "engine": {
          "version": "1.12.1",
          "name": "Secvisogram"
        }
      }
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Microsoft",
        "branches": [
          {
            "category": "product_name",
            "name": "PowerToys (Preview)",
            "branches": [
              {
                "category": "product_version",
                "name": "0.15.2",
                "product": {
                  "product_id": "CSAFPID-0001",
                  "name": "Microsoft PowerToys (Preview) 0.15.2",
                  "product_identification_helper": {
                    "sbom_urls": [
                      "https://raw.githubusercontent.com/rjb4standards/REA-Products/master/UseCaseVDR117/PToysSBOM.spdx"
                    ],
                    "x_generic_uris": [
                      {
                        "namespace": "https://spdx.github.io/spdx-spec/document-creation-information/#65-spdx-document-namespace-field",
                        "uri": "dns:softwareassuranceguardian.com#SPDXRef-Package-43c51b08-cc7e-406d-8ad9-34aa292d1157"
                      }
                    ]
                  }
                }
              }
            ]
          }
        ]
      }
    ],
    "full_product_names": [
      {
        "product_id": "CSAFPID-0002",
        "name": "0.svg",
        "product_identification_helper": {
          "x_generic_uris": [
            {
              "namespace": "https://spdx.github.io/spdx-spec/document-creation-information/#65-spdx-document-namespace-field",
              "uri": "dns:softwareassuranceguardian.com#SPDXRef-e94f7cf7-cb3a-442a-8ced-2a8d4bb1f3e3"
            }
          ]
        }
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2003-0630",
      "product_status": {
        "under_investigation": [
          "CSAFPID-0002"
        ]
      },
      "notes": [
        {
          "category": "description",
          "text": "Multiple buffer overflows in the atari800.svgalib setuid program of the Atari 800 emulator (atari800) before 1.2.2 allow local users to gain privileges via long command line arguments, as demonstrated with the -osa_rom argument.",
          "title": "CVE description"
        }
      ],
      "references": [
        {
          "summary": "NVD - CVE-2003-0630",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0630"
        }
      ],
      "scores": [
        {
          "products": [
            "CSAFPID-0002"
          ],
          "cvss_v2": {
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "baseScore": 7.2,
            "version": "2.0"
          }
        }
      ]
    }
  ]
}

Note: I left out the ones which came back empty - as CSAF doesn't try to produce a full SBOM. It just lists findings, unknowns (or non-findings with the known_not_affected). A profile could have the convention that every item not listed in the CSAF is hasn't listed anything at that time.

tschmidtb51 commented

I'm curious about the added value of searching for index.html in the NVD - but I guess that is a different topic...

rjb4standards commented
rjb4standards commented

The CSAF "CARFAX" example shown appears to use an "implicit" model where only those components that have reported vulnerabilities are listed (like CycloneDX VEX). Correct?

Can you also show an example for an "explicit model" like SBOM VDR where each component is listed, along with the search results, i.e. 0 CVE's or too many CVE's to report

tschmidtb51 commented

The CSAF "CARFAX" example shown appears to use an "implicit" model where only those components that have reported vulnerabilities are listed (like CycloneDX VEX). Correct?

Yes. That is usually how I would suggest to do it as you link them to the SBOM anyway.

Can you also show an example for an "explicit model" like SBOM VDR where each component is listed, along with the search results, i.e. 0 CVE's or too many CVE's to report

Doable? Yes. Listing all elements from the SBOM would duplicate it in the CSAF product_tree but that is not forbidden.
Necessary? Not sure. Correct me if I'm wrong but you wanted to answer the question: What is the vulnerability status of product P, version V from Supplier S at time(t) at the SBOM component level? This implies to me that there are vulnerabilities and components which don't have vulnerabilities could be omitted.

Personally, I would not explicit list the number of search results explicit (that would be data duplication, as we list the CVEs anyway and rather a factor for inconsistency).
Note: CSAF does not limit the number of items/CVEs you can put into the vulnerabilities array. So there are never to many vulnerabilities to report. (Nevertheless, it is recommended not to have more than 100000 items in there...)

rjb4standards commented