artofthepossible / containerconveyervexseastheday

The CVEs that Vex You

containerconveyervexseastheday

Handle those CVEs that Vex You

Executive Summary

The Vulnerability Exploitability eXchange (VEX) is a new standard developed by the NTIA to improve the accuracy of vulnerability assessments.

VEX documents contain information about whether vulnerabilities are exploitable in a product, allowing organizations to filter out false positives from their vulnerability scans.

By using VEX documents in combination with Software Bill of Materials (SBOMs) and vulnerability scanning tools, organizations can enhance the accuracy of their vulnerability assessments and focus on addressing genuine security risks.

The readem demonstrates how VEX can be integrated with Docker Scout to filter out false positives and streamline vulnerability management for development and security teams.

Why Is This Important

The SBOM tells you the composition of the software The CVE tesll you about the vulnerabilities in your environment The VEX document tells you which vulnerabilities you are affected by

Resources

https://www.docker.com/blog/filter-out-security-vulnerability-false-positives-with-vex/