To express the status of any product w.r.t. to being affected by a vulnerability, Status elements contain communicate this via a controlled vocabulary. This Type attribute is an enumerated value that contains all the possible permutations of fixed, affected, and recommended versions of the products referenced inside the Status container. « The following categories MUST be used to enumerate a Vulnerability Product Affected Status Type attribute inside a CSAF CVRF document: First Affected Known Affected Known Not Affected First Fixed Fixed Recommended Last Affected » [CSAF-2.2.16-1] In the following sub sections these seven terms are presented in lexical order and annotated to support interoperable usage and as support for the reader. Vulnerability Product Affected Status Type First Affected — This is first version of the affected release known to be affected by the vulnerability. Vulnerability Product Affected Status Type Known Affected — This version is to be affected by the vulnerability. Vulnerability Product Affected Status Type Model Known Not Affected — This version is known not to be affected by the vulnerability. Vulnerability Product Affected Status Type Model First Fixed — This version contains the first fix for the vulnerability but may not be the recommended fixed version. Vulnerability Product Affected Status Type Model Fixed — This version contains a fix for the vulnerability but may not be the recommended fixed version. Vulnerability Product Affected Status Type Recommended — This version has a fix for the vulnerability and is the vendor-recommended version for fixing the vulnerability. Vulnerability Product Affected Status Type Model Last Affected — This is the last version in a release train known to be affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability. Vulnerability Remediation Type Model Specific details on how to handle (and presumably, fix) a vulnerability are communicated via Remediation containers inside a CSAF CVRF document and a controlled vocabulary is defined for values of the associated Type attribute. A Remediation container can be tied to one or more specific products by referencing these products using either the Product ID or other means. If the Remediation is meant to be general or nonspecific for all products, any Product ID or other IDs are to be omitted.
To express the status of any product w.r.t. to being affected by a vulnerability, Status elements contain communicate this via a controlled vocabulary. This Type attribute is an enumerated value that contains all the possible permutations of fixed, affected, and recommended versions of the products referenced inside the Status container. « The following categories MUST be used to enumerate a Vulnerability Product Affected Status Type attribute inside a CSAF CVRF document: First Affected Known Affected Known Not Affected First Fixed Fixed Recommended Last Affected » [CSAF-2.2.16-1] In the following sub sections these seven terms are presented in lexical order and annotated to support interoperable usage and as support for the reader. Vulnerability Product Affected Status Type — First Affected This is first version of the affected release known to be affected by the vulnerability. Vulnerability Product Affected Status Type — Known Affected This version is to be affected by the vulnerability. Vulnerability Product Affected Status Type Model — Known Not Affected This version is known not to be affected by the vulnerability. Vulnerability Product Affected Status Type Model — First Fixed This version contains the first fix for the vulnerability but may not be the recommended fixed version. Vulnerability Product Affected Status Type Model — Fixed This version contains a fix for the vulnerability but may not be the recommended fixed version. Vulnerability Product Affected Status Type — Recommended This version has a fix for the vulnerability and is the vendor-recommended version for fixing the vulnerability. Vulnerability Product Affected Status Type Model — Last Affected This is the last version in a release train known to be affected by the vulnerability. Subsequently released versions would contain a fix for the vulnerability. Vulnerability Remediation Type Model Specific details on how to handle (and presumably, fix) a vulnerability are communicated via Remediation containers inside a CSAF CVRF document and a controlled vocabulary is defined for values of the associated Type attribute. A Remediation container can be tied to one or more specific products by referencing these products using either the Product ID or other means. If the Remediation is meant to be general or nonspecific for all products, any Product ID or other IDs are to be omitted.
csaf-cvrf-v1.2.docx