Introduction Organization of CSAF CVRF The specification is split into seven chapters. Terminology The key “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in []. Terms and Definitions For the purposes of this document, the following applies: Advisory — as in ISO/IEC [] Coordinator — as in ISO/IEC 29147 [] Finder — as in ISO/IEC 29147 [] Online Services — as in ISO/IEC 29147 [] Product — as in ISO/IEC 29147 [] Remediation — as in ISO/IEC 29147 [] Service — as in ISO/IEC 29147 [] Vendor — as in ISO/IEC 29147 [] Vulnerability — as in ISO/IEC 29147 [] Date Time Value — as defined in section 2.2.1 Positive Integer — integer number > 0 (xs:positiveInteger) cf. [] Cardinality — minimal and maximal occurrence noted as mathematical closed interval with the special symbol (∞) for infinity to indicate no upper limit. Enumeration Set — a finite set of domain values (case-sensitive string literals) implemented via enumerations on cf. [] Abbreviated Terms CCE — Common Configuration Enumeration CSAF — Common Security Advisory Framework CPE — Common Platform Enumeration [] CSIRT — Computer Security Incident Response Team CVE — Common Vulnerabilities and Exposures [] CVRF — Common Vulnerability Reporting Framework CVSS — Common Vulnerability Scoring System [] CWE — Common Weakness Enumeration [] — Internet Consortium for Advancement of Security on the Internet, ID — Identifier OASIS — Organization for the Advancement of Structured Information Standards, PSIRT — Product Security Incident Response Team
Vulnerability – Discovery Date Element vuln:DiscoveryDate The vuln:DiscoveryDate element MUST 2.2.1. ∆ [CSAF-6.5-1] Example : <DiscoveryDate>2010-11-03T00:00:00Z</DiscoveryDate> Vulnerability – Release Date Element vuln:ReleaseDate The vuln:ReleaseDate element MUST 2.2.1∆ [CSAF-6.6-1] Example :
Table of XML Elements and Attributes Element cvrf:cvrfdoc 28 Element cvrf:DocumentTitle 28 Element cvrf:DocumentType 29 Element cvrf:DocumentPublisher 30 Attribute Type 30 Attribute VendorID 30 Element cvrf:ContactDetails 31 Element cvrf:IssuingAuthority 31 Element cvrf:DocumentTracking 32 Element cvrf:Identification 33 Element cvrf:ID 33 Element cvrf:Alias 33 Element cvrf:Status 33 Element cvrf:Version 34 Element cvrf:RevisionHistory 35 Element cvrf:Revision 35 Element cvrf:Number 35 Element cvrf:Date 35 Element cvrf:Description 36 Element cvrf:InitialReleaseDate 36 Element cvrf:CurrentReleaseDate 36 Element cvrf:Generator 37 Element cvrf:Engine 37 Element cvrf:Date 37 Element cvrf:DocumentNotes 39 Element cvrf:Note 40 Attribute Title 40 Attribute Audience 40 Attribute Type 40 Attribute Ordinal 40 Element cvrf:DocumentDistribution 41 Element cvrf:AggregateSeverity 42 Attribute Namespace 42 Element cvrf:DocumentReferences 42 Element cvrf:Reference 43 Attribute Type 43 Element cvrf:URL 43 Element cvrf:Description 43 Element cvrf:Acknowledgements 44 Element cvrf:Acknowledgement 45 Element cvrf:Name 46 Element cvrf:Organization 46 Element cvrf:Description 46 Element cvrf:URL 46 Element prod:ProductTree 49 Element prod:Branch 51 Attribute Name 51 Attribute Type 51 Element prod:FullProductName 53 Attribute ProductID 53 Attribute CPE 53 Element prod:Relationship 54 Attribute ProductReference 54 Attribute RelationType 54 Attribute RelatesToProductReference 54 Element prod:ProductGroups 55 Element prod:Group 57 Attribute GroupID 57 Element prod:Description 57 Element prod:ProductID 57 Element vuln:Vulnerability 60 Attribute Ordinal 60 Element vuln:Title 61 Element vuln:ID 62 Attribute SystemName 62 Element 63 Element vuln:Note 63 Attribute Type 63 Attribute Ordinal 63 Attribute Title 63 Attribute Audience 63 Element vuln:DiscoveryDate 64 Element vuln:ReleaseDate 64 Element vuln:Involvements 65 Element vuln:Involvement 65 Attribute Party 65 Attribute Status 65 Element vuln:Description 65 Element vuln:CVE 66 Element vuln:CWE 67
Element vuln:ProductStatuses 67 Element vuln:Status 67 Attribute Type 67 Element vuln:ProductID 68 Element vuln:Threats 68 Element vuln:Threat 69 Attribute Type 70 Attribute Date 70 Element vuln:Description 70 Element vuln:ProductID 71 Element vuln:GroupID 71 Element vuln:CVSSScoreSets 72 Element vuln:ScoreSetV2 73 Element vuln:BaseScoreV2 73 Element vuln:TemporalScoreV2 73 Element vuln:EnvironmentalScoreV2 73 Element vuln:VectorV2 74 Element vuln:ProductID 75 Element vuln:ScoreSetV3 75 Element vuln:BaseScoreV3 75 Element vuln:TemporalScoreV3 76 Element vuln:EnvironmentalScoreV3 76 Element vuln:VectorV3 76 Element vuln:ProductID 77 Element vuln:Remediations 77 Element vuln:Remediation 79 Attribute Type 79 Element vuln:Description 79 Element vuln:Entitlement 79 Element vuln:URL 80 Element vuln:ProductID 80 Element vuln:GroupID 81 Element vuln:References 81 Element vuln:Reference 83 Attribute Type 83 Element vuln:URL 83 Element vuln:Description 83 Element vuln:Acknowledgements 84 Element vuln:Acknowledgement 85 Element vuln:Name 85 Element vuln:Organization 85 Element vuln:Description 85 Element vuln:URL 86
Index Advisory, 11, 12 CPE, 12 CSAF, 12 CVRF, 12 CVSS, 11, 12, 13 ISO8601, 13 Product, 11, 12, 48 UTC, 13, 37 Vulnerability, 11, 12, 59, 77 Remediations, 77