Democratizing Exploitability Data with OpenVEX
summary
OpenVEX claims to let maintainers publish artifact-level exploitability statements so scanners stop flagging false positives; it ships a JSON‑LD spec plus tooling: vctl CLI to create, merge, sign and attest VEX documents, a discovery plugins system that finds VEX in registries, git and SBOMs, and integrations with scanners like Trivy and Grype. Demonstrations show document histories merging from upstream, distro and consumer VEXes; prototypes work but scale, trust framework and database backends remain in progress.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:09Bogus CVEs against open source
- 7:46What is VEX
- 12:46OpenVEX implementation
- 16:38Who creates VEX statements
- 18:44Building VEX histories
- 27:19OpenVEX Discovery module
- 32:42Call for participation
- 49:54Q&A
related talks
45mVEXing Open Source Security: Vulnerability Data for Everything
19mFinally! Automated End-to-End VEX Streams You Can Trust
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
24mEmbracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
47mI Can’t Cope! How OWASP Is Helping To Manage Vulnerability Overload
30mDistribution Builders Meet VEX
27mWeaving a VEX Feed Through the Kubernetes Project