Introduction IPR This Committee Specification Draft is being developed under the Mode of the , the mode chosen when the Technical Committee was established. For information on whether any patents have been disclosed that may be essential to implementing this specification, and any offers of patent licensing please refer to the Intellectual Property Rights section of the TC’s web page (). Organization of CSAF CVRF The specification is split into seven chapters. Terminology The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in []. Terms and Definitions For the purposes of this document, the following applies: Advisory — as in ISO/IEC 29147 [] Coordinator — as in ISO/IEC 29147 [] Finder — as in ISO/IEC 29147 [] Online Services — as in ISO/IEC [] Product — as in ISO/IEC 29147 [] Remediation — as in ISO/IEC 29147 [] Service — as in ISO/IEC [] Vendor — as in ISO/IEC 29147 [] Vulnerability — as in ISO/IEC 29147 [] Date Time — as defined in section 2.2.1 Positive Integer — integer number > 0 (xs:positiveInteger) cf. [] Cardinality Range — minimal and maximal occurrence noted as mathematical closed interval with the special symbol (∞) for infinity to indicate no upper limit. Enumeration Set — a finite set of domain values (case-sensitive string literals) implemented via enumerations on (xs:token) cf. [] Abbreviated Terms CCE — Common Configuration Enumeration CSAF — Common Security Advisory Framework CPE — Common Platform Enumeration [] CSIRT — Computer Security Incident Response Team CVE — Common Vulnerabilities and Exposures []
Product Branch Type To Product Branches the CSAF CVRF chosen modelling offers Type-Name annotation pairs to describe the characteristics of the labeled Branch, where the Type part is restricted to a fixed vocabulary (an enumeration) and the Name will contain the canonical descriptor or “friendly name” of the Branch. Thus, the Type attribute will describe the category of the Branch in question. « The following eleven categories MUST be used as values for Branch Type fields in CSAF CVRF and including the space between the words if multi word term: Architecture Host Name Language Legacy Patch Level Product Family Product Name Product Version Service Pack Specification Vendor » [CSAF-2.2.3-1] Non-normative comment: descriptions of these eleven values are given in the following subsections. Product Branch Type Model — Architecture The value Architecture of Branch Type indicates the architecture for which the product is intended. Product Branch Type Model — Host Name The value Host Name of Branch Type indicates the host name of a system/service. Product Branch Type Model — Language The value Language of Branch Type indicates the language of the product. Product Branch Type Model — Legacy The value Legacy of Branch Type indicates a nonspecific legacy entry. Product Branch Type Model — Patch Level The value Patch Level of Branch Type indicates the patch level of the product. Product Branch Type — Product Family The value Product Family of Branch Type indicates the product family that the product falls into. Product Branch Type Model — Product Name The Product Name of Branch Type indicates the name of the product. Product Branch Type — Product Version The value Product Version of Branch Type indicates the product version, can be numeric or some other descriptor.
Document References – Reference – Description Element cvrf:Description « The cvrf:Description element MUST exactly once in cvrf:Reference. » [CSAF-4.9.1.2-1] « Any instance MUST contain a non-empty string representing the description of the related document. » [CSAF-4.9.1.2-2] Non-normative comment: This can be a descriptive or the name of the referenced artifact. Example : <References> <Reference Type="External"> <URL>http://example.com/bar/</URL> <Description xml:lang="fr">C'est un test de référence</Description> </Reference> </References> Acknowledgements Element cvrf:Acknowledgements « The optional cvrf:Acknowledgements element if present MUST be in cvrf:cvrfdoc. » [CSAF-4.10-1] « An instance MUST contain one or more cvrf:Acknowledgement elements. » [CSAF-4.10-2] The cvrf:Acknowledgements element is a container that SHOULD provide a in the children cvrf:Acknowledgement elements to note recognition of external parties. Following is a visual representation of some valid Document Acknowledgements configuration including the parent node cvrf:cvrfdoc (Document Root) — again with the node labeled {…} indicating further possible Acknowledgement subtrees: Figure : A topologically Document Acknowledgements configuration.
Advisory, 12, 13 CPE, 13 CSAF, 13 CVRF, 13 CVSS, 12, 13, 14 ISO8601, 14 Product, 12, 13, 48 UTC, 14, 39 Vulnerability, 12, 13, 59, 77 Remediations, 77