Introduction IPR Policy This Committee Specification is being developed under the Mode of the , the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC’s web page (). Organization of CSAF CVRF The specification is split into seven chapters. Terminology The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in []. Terms and Definitions For the purposes of this document, the following applies: Advisory — as in ISO/IEC 29147 [] Coordinator — as in ISO/IEC [] Finder — as in ISO/IEC 29147 [] Online Services — as in ISO/IEC 29147 [] Product — as in ISO/IEC 29147 [] Remediation — as in ISO/IEC 29147 [] Service — as in ISO/IEC 29147 [] Vendor — as in ISO/IEC [] Vulnerability — as in ISO/IEC 29147 [] Date Time Value — as defined in section 2.2.1 Positive Integer — integer number > 0 (xs:positiveInteger) cf. [] Cardinality Range — minimal and maximal occurrence noted as mathematical closed interval with the special symbol (∞) for infinity to indicate no upper limit. Enumeration Set — a finite set of domain values (case-sensitive string literals) implemented via enumerations on (xs:token) cf. [] Abbreviated CCE — Common Configuration Enumeration CSAF — Common Security Advisory Framework CPE — Common Platform Enumeration [] CSIRT — Computer Security Incident Response Team CVE — Common Vulnerabilities and Exposures []
To express the status of any product w.r.t. to being affected by a vulnerability, Status elements contain communicate this via a controlled vocabulary. This Type attribute is an enumerated value that contains all the possible permutations of fixed, affected, and recommended versions of the products referenced inside the Status container. « The following categories MUST be used to enumerate a Vulnerability Product Affected Status Type attribute inside a CSAF CVRF document: First Affected Known Affected Known Not Affected First Fixed Fixed Recommended Last Affected » [CSAF-2.2.16-1] In the following sub sections these seven terms are presented in lexical order and annotated to support interoperable usage and as support for the reader. Vulnerability Product Affected Status Type — First Affected This is first version of the affected release known to be affected by the vulnerability. Vulnerability Product Affected Status Type — Known Affected This version is to be affected by the vulnerability. Vulnerability Product Affected Status Type Model — Known Not Affected This version is known not to be affected by the vulnerability. Vulnerability Product Affected Status Type Model — First Fixed This version contains the first fix for the vulnerability but may not be the recommended fixed version. Vulnerability Product Affected Status Type Model — Fixed This version contains a fix for the vulnerability but may not be the recommended fixed version. Vulnerability Product Affected Status Type — Recommended This version has a fix for the vulnerability and is the vendor-recommended version for fixing the vulnerability. Vulnerability Product Affected Status Type Model — Last Affected This is the last version in a release train known to be affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability. Vulnerability Remediation Type Model Specific details on how to handle (and presumably, fix) a vulnerability are communicated via Remediation containers inside a CSAF CVRF document and a controlled vocabulary is defined for values of the associated Type attribute. A Remediation container can be tied to one or more specific products by referencing these products using either the Product ID or other means. If the Remediation is meant to be general or nonspecific for all products, any Product ID or other IDs are to be omitted.
Index Advisory, 12, 13 CPE, 13 CSAF, 13 CVRF, 13 CVSS, 12, 13, 14 ISO8601, 14 Product, 12, 13, 47 UTC, 14, 38 Vulnerability, 12, 13, 57, 72 Remediations, 72