Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handling vulnerabilities with multiple CWEs #530

Closed
achrinza opened this issue May 13, 2022 · 5 comments · Fixed by #741
Closed

Handling vulnerabilities with multiple CWEs #530

achrinza opened this issue May 13, 2022 · 5 comments · Fixed by #741
Assignees
Labels
csaf 2.1 csaf 2.1 work editor-revision already worked on in the editor revision

Comments

@achrinza
Copy link

achrinza commented May 13, 2022

Currently CSAF 2.0 only permits a single CWE entry per-vulnerability. This is in contrast to vulnerability databases (e.g. GitHub Advisory Database, OSV) where each entry represents a single vulnerability, of which permits attaching multiple CWEs.

Although #385 clarifies that historically, the CVRF spec did not permit mulitple CWEs on paper, I was not able to find the rationale for the design choice.

In these cases, what would be the best way to represent multiple CWEs for a vulnerability?

Edit:
The CVE Schema GitHub issue for reference: CVEProject/cve-schema#171

@santosomar
Copy link
Contributor

This is a great point. In some cases multiple CWEs could be applied to a single vulnerability. There was no true rationale behind this in CVRF. This could be a good suggestion and enhancement for the next version of CSAF. Thank you 🙏

@tschmidtb51
Copy link
Contributor

I always thought a vulnerability should have only one CWE ("the one that matches best") 🤔
Some additional questions:

  • What does CVE allow/require?
  • Could somebody provide a real-world example where I would assign more than one CWE?

@rselph-tibco
Copy link

CVE allows multiple CWEs under the container's "problemTypes" array.

@santosomar
Copy link
Contributor

santosomar commented Nov 29, 2023

Thomas Schmidt proposed a motion, as detailed in this OASIS mailing list archive, to change the schema in CSAF 2.1 to allow multiple CWE entries per vulnerabilities. Stefan Hagen seconded the motion. There were no discussions or objections raised, and consequently, the motion was automatically passed on November 1, 2023, at 20:00 UTC.

@tschmidtb51 tschmidtb51 added csaf 2.1 csaf 2.1 work and removed question email To be sent via email to the TC tc-discussion-needed labels Nov 29, 2023
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue May 25, 2024
- addresses parts of oasis-tcs#530
- wrap CWE into a list to allow multiple CWEs per vulnerability
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue May 25, 2024
- addresses parts of oasis-tcs#530, oasis-tcs#154
- adopt prose to reflect schema
- remove conversion rule for CVRF CSAF converter
- reorder CVRF CSAF converter rules regarding CWEs
- clarify warning regarding conversion of CWE category and view
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue May 25, 2024
- addresses parts of oasis-tcs#530
- adopt test 6.1.11 to reflect schema
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue May 25, 2024
- addresses parts of oasis-tcs#530
- adopt examples to reflect schema
- adopt testdata to reflect schema
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue May 25, 2024
- addresses parts of oasis-tcs#530, oasis-tcs#660
- add `/vulnerabilities[]/cwes[]/version` to guidance on size
- add `/vulnerabilities[]/cwes` to guidance on size
- adopt pathes to match schema
@tschmidtb51 tschmidtb51 added the editor-revision already worked on in the editor revision label May 25, 2024
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue May 25, 2024
- addresses parts of oasis-tcs#530
- add invalid example for 6.1.11
- add valid example for 6.1.11
@tschmidtb51
Copy link
Contributor

tschmidtb51 commented Jan 29, 2025

@tschmidtb51 tschmidtb51 mentioned this issue Jan 29, 2025
4 tasks
tschmidtb51 added a commit to tschmidtb51/csaf that referenced this issue Jan 31, 2025
- addresses parts of oasis-tcs#530, oasis-tcs#841
- rephrase test 6.1.11 and 6.3.4 to clarify the test according to the change to multiple CWEs
sthagen added a commit that referenced this issue Feb 14, 2025
* Support multiple purl identifiers in product_identification_helper

This allows a vendor to specify multiple purl identifiers for a single
component (present as a product version branch in the product tree).
Multiple purls may identify the same component but point to different
locations from where that component may be available. Thus, it is mandatory
that if multiple purls are present in a single
product_identification_helper object, they must only differ in their
qualifiers. Otherwise they should be set up as different product
tree branches.

* PURLs

- addresses parts of #774
- assign new test number based on current master branch

* PURLs

- addresses parts of #774, #781, #693
- add `\\` to mask `/` (based on discussion in #693)

* PURLs

- addresses parts of #774, #781
- adapt prose to meet writing style and align with schema

* PURLs

- addresses parts of #774, #781
- sort list entries

* PURLs

- addresses parts of #774, #781, #341
- improve wording
- add valid example

* PURLs

- addresses parts of #774, #781, #341
- improve wording of 6.1.42
- move tests to testfiles
- add invalid examples
- add valid examples
- adapt test schema

* Test 6.1.13

- addresses parts of #774, #781, #341
- add valid example
- add invalid example for oci case (not namespace allowed)

* Fixed nits in participants table

- names and affiliations should match roster
- sorted lines

* Seed Editor revision 2025-01-29

- update dates
- insert new revision for tracking

* ROLIE update

- addresses parts of #677
- add `last_updated` ROLIE section in PMD schema

* ROLIE update

- addresses parts of #677
- adapt examples to reflect change

* Hardware and Software

- addresses parts of #817
- add section about hardware/software separation with example
- add full describe rule

* Nit: incomplete word

* Hardware and Software

- addresses parts of #817
- add optional test to detect potential mixing of hard- and software (6.2.31)
- add invalid example
- add valid examples

* Hardware and Software

- addresses parts of #817
- clarify the informative note about test failure

* Hardware and Software

- addresses parts of review comment of #857
- state linking in vulnerability section as example

* Hardware and Software

- addresses parts of review comment of #857
- soften statement and link to CVE statistics

* Hardware and Software

- addresses parts of review comment of #857
- remove "prohibited" from informative paragraph

* Update csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md

Co-authored-by: tschmidtb51 <[email protected]>

* Candidate rewording of informative text

Feel free to revert ...

* Hardware and Software

- addresses parts of #817
- add optional test to detect multiple same PIH (6.2.32)
- add invalid examples
- add valid examples

* Hardware and Software

- addresses parts of review comment of #857
- remove merge artifact
- clarify text regarding matching

* Hardware and Software

- addresses parts of #817
- add invalid example
- update testcases

* Hardware and Software

- addresses parts of #817
- update testcase schema to add new test 6.2.32

* Editorial

- addresses parts of #841
- correct vers example by removing invalid space

* Editorial

- addresses parts of #841
- update link to vers

* Editorial

- addresses parts of #841
- update count of conformance targets

* Editorial

- addresses parts of #841
- fix refs in date and time (wrong brackets)

* Editorial

- addresses parts of #841
- fix format mistake
- add section 5 to be of relevance for conformance

* Editorial

- addresses parts of #841
- sort guidance on size
- remove obsolete scores from guidance on size

* Editorial

- addresses parts of #841
- update OpenSSL digest list

* Editorial

- addresses parts of #841
- update reference to ISO 8601

* Editorial

- addresses parts of #841
- update SBOM format references

* CWEs

- addresses parts of #530, #841
- rephrase test 6.1.11 and 6.3.4 to clarify the test according to the change to multiple CWEs

* PURLs

- addresses parts of #774, #841
- add conversion rule
- correct JSON path by adding missing `product_identification_helper` part

* Editorial

- addresses parts of #841
- update missing dates
- update CVE link

* Editorial

- addresses parts of #841, #817, #629
- clearly state that additional conventions have to be respected by the consumer

* Suggested edit of CVE reference

* Added missing section entries

* Amended example and section label mappings

* Rendered user facing delivery items

---------

Signed-off-by: Stefan Hagen <[email protected]>
Co-authored-by: Martin Prpič <[email protected]>
Co-authored-by: Stefan Hagen <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
csaf 2.1 csaf 2.1 work editor-revision already worked on in the editor revision
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants