Skip to content
GitHub no longer supports this web browser. Learn more about the browsers we support.
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft vulnerability schema extension #19

Merged
@@ -0,0 +1,267 @@
<?xml version="1.0" encoding="UTF-8"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:vc="http://www.w3.org/2007/XMLSchema-versioning"
xmlns:vuln="http://cyclonedx.org/schema/ext/vulnerability/1.0"
elementFormDefault="qualified"
targetNamespace="http://cyclonedx.org/schema/ext/vulnerability/1.0"
vc:minVersion="1.0"
vc:maxVersion="1.1"
version="1.0.0-SNAPSHOT">

<xs:simpleType name="severityType" final="restriction">
<xs:annotation>
<xs:documentation xml:lang="en">
Textual representation of the severity of the vulnerability adopted by the risk analysis method.
If an other risk analysis method is used other than whats defined in scoreSourceType,
the user is expected to translate appropriately to match with an element value below.
</xs:documentation>
</xs:annotation>
<xs:restriction base="xs:string">
<xs:enumeration value="None"/>
This conversation was marked as resolved by stevespringett

This comment has been minimized.

Copy link
@stevespringett

stevespringett Sep 5, 2019

Member

I think 'Unknown' may be a better term. 'None' could be confused to mean a INFO level warning rather than a vulnerability of unknown severity.

This comment has been minimized.

Copy link
@ja98200wilcox

ja98200wilcox Sep 9, 2019

I think 'Unknown' may be a better term. 'None' could be confused to mean a INFO level warning rather than a vulnerability of unknown severity.

'None' came from the cvss ratings. My understanding is 'None' means there’s next to no threat. 'Unknown' would be the score hasn’t been calculated.

Screen Shot 2019-09-06 at 2 22 32 PM

This comment has been minimized.

Copy link
@kakumara

kakumara Sep 9, 2019

Author Contributor

'None' came from the cvss ratings. My understanding is 'None' means there’s next to no threat. 'Unknown' would be the score hasn’t been calculated.

I've added Unknown to the list of options as well. c3af551

<xs:enumeration value="Low"/>
<xs:enumeration value="Medium"/>
<xs:enumeration value="High"/>
<xs:enumeration value="Critical"/>
<xs:enumeration value="Unknown"/>
</xs:restriction>
</xs:simpleType>

<xs:simpleType name="scoreValueType">
<xs:annotation>
<xs:documentation xml:lang="en">
Numerical representation of the vulnerability score.
Must be a number between 0 - 10 (maps to lowest severity - highest severity)
</xs:documentation>
</xs:annotation>
<xs:restriction base="xs:decimal">
<xs:minInclusive value="0"/>
<xs:fractionDigits value="1"/>
<xs:maxInclusive value="10"/>
</xs:restriction>
</xs:simpleType>

<xs:simpleType name="scoreSourceType" final="restriction">
<xs:annotation>
<xs:documentation xml:lang="en">
Specifies the risk scoring methodology/standard used.
</xs:documentation>
</xs:annotation>
<xs:restriction base="xs:string">
<xs:enumeration value="CVSSv2">
<xs:annotation>
<xs:documentation xml:lang="en">
The rating is based on CVSS v2 standard
https://www.first.org/cvss/v2/guide
</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="CVSSv3">
<xs:annotation>
<xs:documentation xml:lang="en">
The rating is based on CVSS v3 standard
https://www.first.org/cvss/v3.1/specification-document
</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="OWASP Risk">
<xs:annotation>
<xs:documentation xml:lang="en">
The rating is based on OWASP Risk Rating
https://www.owasp.org/index.php/OWASP_Risk_Rating_Methodology
</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Open FAIR">
<xs:annotation>
<xs:documentation xml:lang="en">
The rating is based on Open FAIR specification
http://www.opengroup.org/subjectareas/security/risk
</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Other">
<xs:annotation>
<xs:documentation xml:lang="en">
Use this if the risk scoring methodology is not based on any of the options above
</xs:documentation>
</xs:annotation>
</xs:enumeration>
</xs:restriction>
</xs:simpleType>

<xs:complexType name="scoreType">
<xs:annotation>
<xs:documentation xml:lang="en">
Defines the numerical risk score of a vulnerability
</xs:documentation>
</xs:annotation>
<xs:sequence>
<xs:element name="score" minOccurs="0" maxOccurs="1">
<xs:complexType>
<xs:sequence>
<xs:element name="base" type="vuln:scoreValueType" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation xml:lang="en">
The base score of the security vulnerability (Refer CVSS standard for example)
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="impact" type="vuln:scoreValueType" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation xml:lang="en">
The impact subscore of the security vulnerability (Refer CVSS standard for example)
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="exploitability" type="vuln:scoreValueType" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation xml:lang="en">
The exploitability subscore of the security vulnerability (Refer CVSS standard for
example)
</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="severity" type="vuln:severityType" minOccurs="0" maxOccurs="1"/>
<xs:element name="method" type="vuln:scoreSourceType" minOccurs="0" maxOccurs="1"/>
<xs:element name="vector" type="xs:string" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation xml:lang="en">
Textual representation of the metric values used to score the vulnerability
see attack vector in https://www.first.org/cvss/v3.1/specification-document
</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
</xs:complexType>

<xs:complexType name="vulnerability">
<xs:annotation>
<xs:documentation xml:lang="en">
Defines the structure of a vulnerability.
</xs:documentation>
</xs:annotation>
<xs:sequence>
<xs:element name="id" type="xs:normalizedString" minOccurs="1" maxOccurs="1">
<xs:annotation>
<xs:documentation xml:lang="en">
The id of the vulnerability as defined by the risk scoring methodology
For example CVE-2019-15842 (of https://nvd.nist.gov/vuln/detail/CVE-2019-15842)
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="source" minOccurs="0" maxOccurs="1">
<xs:complexType>
<xs:annotation>
<xs:documentation xml:lang="en">
The source of the vulnerability where it is documented.
Usually the name of the organization publishing vulnerability information
</xs:documentation>
</xs:annotation>
<xs:sequence>
<xs:element name="url" minOccurs="0" type="xs:anyURI" maxOccurs="1">
<xs:annotation>
<xs:documentation xml:lang="en">
The url of the vulnerability documentation as provided by the source
For example https://nvd.nist.gov/vuln/detail/CVE-2019-15842
</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
<xs:attribute name="name" type="xs:normalizedString" use="required">
<xs:annotation>
<xs:documentation xml:lang="en">
The name of the source. For example "National Vulnerability Database"
</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
</xs:element>
<xs:element name="ratings" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation xml:lang="en">
List of the vulnerability ratings as defined by various risk rating methodologies.
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="rating" type="vuln:scoreType" minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="cwes" minOccurs="0" maxOccurs="1">
<xs:complexType>
<xs:annotation>
<xs:documentation xml:lang="en">
List of Common Weaknesses Enumerations (CWEs) codes that describes this vulnerability.
For example 399 (of https://cwe.mitre.org/data/definitions/399.html)
</xs:documentation>
</xs:annotation>
<xs:sequence minOccurs="0" maxOccurs="unbounded">
<xs:element name="cwe" type="xs:integer" minOccurs="0" maxOccurs="1"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation xml:lang="en">
Description of the vulnerability as provided by the source organization
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="recommendations" minOccurs="0" maxOccurs="1">
<xs:complexType>
<xs:annotation>
<xs:documentation xml:lang="en">
The remediation options for the vulnerability if available
</xs:documentation>
</xs:annotation>
<xs:sequence minOccurs="0" maxOccurs="unbounded">
<xs:element name="recommendation" type="xs:string">
<xs:annotation>
<xs:documentation xml:lang="en">
A recommendation of how the perticular vulnerability can be avoided/mitigated.
</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="advisories" minOccurs="0" maxOccurs="1">
<xs:complexType>
<xs:annotation>
<xs:documentation xml:lang="en">
Published advisories of the vulnerability if provided
</xs:documentation>
</xs:annotation>
<xs:sequence minOccurs="0" maxOccurs="unbounded">
<xs:element name="advisory" type="xs:string"/>
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:sequence>
<xs:attribute name="ref" type="xs:string" use="required">
<xs:annotation>
<xs:documentation>References a component by the components bom-ref attribute</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>

<xs:element name="vulnerabilities">

This comment has been minimized.

Copy link
@stevespringett

stevespringett Sep 5, 2019

Member

Is the intended use of the vulnerabilities node to reside inside each component?

<bom>
  <components>
    <component>
      <dg:vulnerabilities>
        <dg:vulnerability>
        </dg:vulnerability>
      </dg:vulnerabilities>
    </component>
  </components>
</bom>

Whatever the intended location, guidance in the form of documentation would be necessary

This comment has been minimized.

Copy link
@ja98200wilcox

ja98200wilcox Sep 5, 2019

Is the intended use of the vulnerabilities node to reside inside each component?

That is the intended location to be inside a component element. Seems like a natural fit. Would you rather have it somewhere else?

This comment has been minimized.

Copy link
@stevespringett

stevespringett Sep 5, 2019

Member

Makes perfect sense to me as well, but the element wasn't annotated with documentation that provided any guidance. So although I assumed this to be the case, the specification did not explicitly state that.

This comment has been minimized.

Copy link
@ja98200wilcox

ja98200wilcox Sep 5, 2019

guidance in the form of documentation would be necessary

Will add appropriate documentation elements that provide guidance

<xs:annotation>
<xs:documentation xml:lang="en">
Defines a list of vulnerabilities.
Vulnerabilities are intended to be used inside the BOM component element.
Extending a component ability to declare associated vulnerability information.
Each component element optionally can add a vulnerabilities element.
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence minOccurs="0" maxOccurs="unbounded">
<xs:element name="vulnerability" type="vuln:vulnerability"/>
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:schema>
ProTip! Use n and p to navigate between commits in a pull request.
You can’t perform that action at this time.