New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Draft vulnerability schema extension #19
Changes from all commits
3c2e377
efa5e75
66c3ff8
835cc13
5c75f6f
c3af551
561f435
e38e9c4
35bb842
44a9bfa
57d27d8
b2e2b00
File filter...
Jump to…
| @@ -0,0 +1,267 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" | ||
| xmlns:vc="http://www.w3.org/2007/XMLSchema-versioning" | ||
| xmlns:vuln="http://cyclonedx.org/schema/ext/vulnerability/1.0" | ||
| elementFormDefault="qualified" | ||
| targetNamespace="http://cyclonedx.org/schema/ext/vulnerability/1.0" | ||
| vc:minVersion="1.0" | ||
| vc:maxVersion="1.1" | ||
| version="1.0.0-SNAPSHOT"> | ||
|
|
||
| <xs:simpleType name="severityType" final="restriction"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| Textual representation of the severity of the vulnerability adopted by the risk analysis method. | ||
| If an other risk analysis method is used other than whats defined in scoreSourceType, | ||
| the user is expected to translate appropriately to match with an element value below. | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| <xs:restriction base="xs:string"> | ||
| <xs:enumeration value="None"/> | ||
|
This conversation was marked as resolved
by stevespringett
kakumara
Author
Contributor
|
||
| <xs:enumeration value="Low"/> | ||
| <xs:enumeration value="Medium"/> | ||
| <xs:enumeration value="High"/> | ||
| <xs:enumeration value="Critical"/> | ||
| <xs:enumeration value="Unknown"/> | ||
| </xs:restriction> | ||
| </xs:simpleType> | ||
|
|
||
| <xs:simpleType name="scoreValueType"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| Numerical representation of the vulnerability score. | ||
| Must be a number between 0 - 10 (maps to lowest severity - highest severity) | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| <xs:restriction base="xs:decimal"> | ||
| <xs:minInclusive value="0"/> | ||
| <xs:fractionDigits value="1"/> | ||
| <xs:maxInclusive value="10"/> | ||
| </xs:restriction> | ||
| </xs:simpleType> | ||
|
|
||
| <xs:simpleType name="scoreSourceType" final="restriction"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| Specifies the risk scoring methodology/standard used. | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| <xs:restriction base="xs:string"> | ||
| <xs:enumeration value="CVSSv2"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The rating is based on CVSS v2 standard | ||
| https://www.first.org/cvss/v2/guide | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:enumeration> | ||
| <xs:enumeration value="CVSSv3"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The rating is based on CVSS v3 standard | ||
| https://www.first.org/cvss/v3.1/specification-document | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:enumeration> | ||
| <xs:enumeration value="OWASP Risk"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The rating is based on OWASP Risk Rating | ||
| https://www.owasp.org/index.php/OWASP_Risk_Rating_Methodology | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:enumeration> | ||
| <xs:enumeration value="Open FAIR"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The rating is based on Open FAIR specification | ||
| http://www.opengroup.org/subjectareas/security/risk | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:enumeration> | ||
| <xs:enumeration value="Other"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| Use this if the risk scoring methodology is not based on any of the options above | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:enumeration> | ||
| </xs:restriction> | ||
| </xs:simpleType> | ||
|
|
||
| <xs:complexType name="scoreType"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| Defines the numerical risk score of a vulnerability | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| <xs:sequence> | ||
| <xs:element name="score" minOccurs="0" maxOccurs="1"> | ||
| <xs:complexType> | ||
| <xs:sequence> | ||
| <xs:element name="base" type="vuln:scoreValueType" minOccurs="0" maxOccurs="1"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The base score of the security vulnerability (Refer CVSS standard for example) | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:element> | ||
| <xs:element name="impact" type="vuln:scoreValueType" minOccurs="0" maxOccurs="1"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The impact subscore of the security vulnerability (Refer CVSS standard for example) | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:element> | ||
| <xs:element name="exploitability" type="vuln:scoreValueType" minOccurs="0" maxOccurs="1"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The exploitability subscore of the security vulnerability (Refer CVSS standard for | ||
| example) | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:element> | ||
| </xs:sequence> | ||
| </xs:complexType> | ||
| </xs:element> | ||
| <xs:element name="severity" type="vuln:severityType" minOccurs="0" maxOccurs="1"/> | ||
| <xs:element name="method" type="vuln:scoreSourceType" minOccurs="0" maxOccurs="1"/> | ||
| <xs:element name="vector" type="xs:string" minOccurs="0" maxOccurs="1"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| Textual representation of the metric values used to score the vulnerability | ||
| see attack vector in https://www.first.org/cvss/v3.1/specification-document | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:element> | ||
| </xs:sequence> | ||
| </xs:complexType> | ||
|
|
||
| <xs:complexType name="vulnerability"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| Defines the structure of a vulnerability. | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| <xs:sequence> | ||
| <xs:element name="id" type="xs:normalizedString" minOccurs="1" maxOccurs="1"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The id of the vulnerability as defined by the risk scoring methodology | ||
| For example CVE-2019-15842 (of https://nvd.nist.gov/vuln/detail/CVE-2019-15842) | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:element> | ||
| <xs:element name="source" minOccurs="0" maxOccurs="1"> | ||
| <xs:complexType> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The source of the vulnerability where it is documented. | ||
| Usually the name of the organization publishing vulnerability information | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| <xs:sequence> | ||
| <xs:element name="url" minOccurs="0" type="xs:anyURI" maxOccurs="1"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The url of the vulnerability documentation as provided by the source | ||
| For example https://nvd.nist.gov/vuln/detail/CVE-2019-15842 | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:element> | ||
| </xs:sequence> | ||
| <xs:attribute name="name" type="xs:normalizedString" use="required"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The name of the source. For example "National Vulnerability Database" | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:attribute> | ||
| </xs:complexType> | ||
| </xs:element> | ||
| <xs:element name="ratings" minOccurs="0" maxOccurs="1"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| List of the vulnerability ratings as defined by various risk rating methodologies. | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| <xs:complexType> | ||
| <xs:sequence> | ||
| <xs:element name="rating" type="vuln:scoreType" minOccurs="0" maxOccurs="unbounded"/> | ||
| </xs:sequence> | ||
| </xs:complexType> | ||
| </xs:element> | ||
| <xs:element name="cwes" minOccurs="0" maxOccurs="1"> | ||
| <xs:complexType> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| List of Common Weaknesses Enumerations (CWEs) codes that describes this vulnerability. | ||
| For example 399 (of https://cwe.mitre.org/data/definitions/399.html) | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| <xs:sequence minOccurs="0" maxOccurs="unbounded"> | ||
| <xs:element name="cwe" type="xs:integer" minOccurs="0" maxOccurs="1"/> | ||
| </xs:sequence> | ||
| </xs:complexType> | ||
| </xs:element> | ||
| <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| Description of the vulnerability as provided by the source organization | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:element> | ||
| <xs:element name="recommendations" minOccurs="0" maxOccurs="1"> | ||
| <xs:complexType> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| The remediation options for the vulnerability if available | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| <xs:sequence minOccurs="0" maxOccurs="unbounded"> | ||
| <xs:element name="recommendation" type="xs:string"> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| A recommendation of how the perticular vulnerability can be avoided/mitigated. | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| </xs:element> | ||
| </xs:sequence> | ||
| </xs:complexType> | ||
| </xs:element> | ||
| <xs:element name="advisories" minOccurs="0" maxOccurs="1"> | ||
| <xs:complexType> | ||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| Published advisories of the vulnerability if provided | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| <xs:sequence minOccurs="0" maxOccurs="unbounded"> | ||
| <xs:element name="advisory" type="xs:string"/> | ||
| </xs:sequence> | ||
| </xs:complexType> | ||
| </xs:element> | ||
| </xs:sequence> | ||
| <xs:attribute name="ref" type="xs:string" use="required"> | ||
| <xs:annotation> | ||
| <xs:documentation>References a component by the components bom-ref attribute</xs:documentation> | ||
| </xs:annotation> | ||
| </xs:attribute> | ||
| </xs:complexType> | ||
|
|
||
| <xs:element name="vulnerabilities"> | ||
stevespringett
Member
|
||
| <xs:annotation> | ||
| <xs:documentation xml:lang="en"> | ||
| Defines a list of vulnerabilities. | ||
| Vulnerabilities are intended to be used inside the BOM component element. | ||
| Extending a component ability to declare associated vulnerability information. | ||
| Each component element optionally can add a vulnerabilities element. | ||
| </xs:documentation> | ||
| </xs:annotation> | ||
| <xs:complexType> | ||
| <xs:sequence minOccurs="0" maxOccurs="unbounded"> | ||
| <xs:element name="vulnerability" type="vuln:vulnerability"/> | ||
| </xs:sequence> | ||
| </xs:complexType> | ||
| </xs:element> | ||
| </xs:schema> | ||

I think 'Unknown' may be a better term. 'None' could be confused to mean a INFO level warning rather than a vulnerability of unknown severity.