Communicate known and unknown vulnerabilities affecting components and services
Known vulnerabilities inherited from the use of third-party and open source software can be communicated with CycloneDX. Previously unknown vulnerabilities affecting both components and services may also be disclosed using CycloneDX, making it ideal for Vulnerability Disclosure Report (VDR) use cases.
NIST SP 800-161: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations defines Vulnerability Disclosure Reports (VDR) as a best practice and recommends VDRs include:
CycloneDX exceeds the data field requirements defined in ISO/IEC 29147:2018 for vulnerability disclosure information and provides a simple path for including Vulnerability Exploitability eXchange (VEX) information.
CycloneDX fully supports all NIST recommendations for VDR including:
With CycloneDX, it is possible to reference a component, service, or vulnerability inside a BOM from other systems or other BOMs. This deep-linking capability is referred to as BOM-Link and is a formally registered URN.
Learn more about how CycloneDX makes use of BOM-Link.
CycloneDX VDR BOMs can also be used with alternative SBOM formats such as SPDX, but without the tight integration or support of an IETF standard for linkage. Vendor support may vary.
CycloneDX also supports embedding VDR information inside a BOM, thus having a single artifact that describes both inventory and VDR data. There are several uses for embedding VDR data including:
BOMs demonstrating VDR capabilities can be found at https://github.com/CycloneDX/bom-examples
