zmanion / sbom Goto Github PK

From the discussion on #2, consider being more strict about requiring version for VEX components/products.

https://groups.google.com/g/cisa-sbom-vex/c/qmvza5Evu3I/m/514S9dKRAAAJ

https://groups.google.com/g/cisa-sbom-vex/c/qmvza5Evu3I/m/Q_bJ3wOSAAAJ

From a CISA VEX WG mailing list thread proposing a new VEX status:

2.7.1.5 Risk Accepted (“risk_accepted”)

The [author] of the VEX statement or other relevant parties have ruled this [vul_id] as presenting an insignificant risk, and will not further investigate the [vul_id] to assess whether it is “not_affected” or “affected” and will not further update the [status] of this [vul_id].

We believe this is a common practice in the Industry, for [vul_id]s of very low actual risk. This scenario is not satisfied by [status] being set to “not_affected” or by “under_investigation” as there will be no further investigation to find whether or not the product affected by the [vul_id], and the Status will not progress to any other value from this state (no further investigation will be performed).