Skip to content

Commit a719b63

Browse files
stevespringettstevespringett
authored
Merge pull request #200 from CycloneDX/v1.5-dev-vulnerability-poc
Add proof of concept support to vulnerability
2 parents 6771127 + 8d60898 commit a719b63

6 files changed

Lines changed: 113 additions & 5 deletions

File tree

‎schema/bom-1.5.proto‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -701,7 +701,7 @@ message Vulnerability {
701701
repeated int32 cwes = 6;
702702
// A description of the vulnerability as provided by the source.
703703
optional string description = 7;
704-
// If available, an in-depth description of the vulnerability as provided by the source organization. Details often include examples, proof-of-concepts, and other information useful in understanding root cause.
704+
// If available, an in-depth description of the vulnerability as provided by the source organization. Details often include information useful in understanding root cause.
705705
optional string detail = 8;
706706
// Recommendations of how the vulnerability can be remediated or mitigated.
707707
optional string recommendation = 9;
@@ -725,6 +725,19 @@ message Vulnerability {
725725
repeated Property properties = 18;
726726
// The date and time (timestamp) when the vulnerability record was rejected (if applicable).
727727
optional google.protobuf.Timestamp rejected = 19;
728+
// Evidence used to reproduce the vulnerability.
729+
optional ProofOfConcept proofOfConcept = 20;
730+
// A bypass, usually temporary, of the vulnerability that reduces its likelihood and/or impact. Workarounds often involve changes to configuration or deployments.
731+
optional string workaround = 21;
732+
}
733+
734+
message ProofOfConcept {
735+
// Precise steps to reproduce the vulnerability.
736+
optional string reproductionSteps = 1;
737+
// A description of the environment in which reproduction was possible.
738+
optional string environment = 2;
739+
// Supporting material that helps in reproducing or understanding how reproduction is possible. This may include screenshots, payloads, and PoC exploit code.
740+
repeated AttachedText supportingMaterial = 3;
728741
}
729742

730743
message VulnerabilityReference {

‎schema/bom-1.5.schema.json‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1912,13 +1912,41 @@
19121912
"detail": {
19131913
"type": "string",
19141914
"title": "Details",
1915-
"description": "If available, an in-depth description of the vulnerability as provided by the source organization. Details often include examples, proof-of-concepts, and other information useful in understanding root cause."
1915+
"description": "If available, an in-depth description of the vulnerability as provided by the source organization. Details often include information useful in understanding root cause."
19161916
},
19171917
"recommendation": {
19181918
"type": "string",
1919-
"title": "Details",
1919+
"title": "Recommendation",
19201920
"description": "Recommendations of how the vulnerability can be remediated or mitigated."
19211921
},
1922+
"workaround": {
1923+
"type": "string",
1924+
"title": "Workarounds",
1925+
"description": "A bypass, usually temporary, of the vulnerability that reduces its likelihood and/or impact. Workarounds often involve changes to configuration or deployments."
1926+
},
1927+
"proofOfConcept": {
1928+
"type": "object",
1929+
"title": "Proof of Concept",
1930+
"description": "Evidence used to reproduce the vulnerability.",
1931+
"properties": {
1932+
"reproductionSteps": {
1933+
"type": "string",
1934+
"title": "Steps to Reproduce",
1935+
"description": "Precise steps to reproduce the vulnerability."
1936+
},
1937+
"environment": {
1938+
"type": "string",
1939+
"title": "Environment",
1940+
"description": "A description of the environment in which reproduction was possible."
1941+
},
1942+
"supportingMaterial": {
1943+
"type": "array",
1944+
"title": "Supporting Material",
1945+
"description": "Supporting material that helps in reproducing or understanding how reproduction is possible. This may include screenshots, payloads, and PoC exploit code.",
1946+
"items": { "$ref": "#/definitions/attachment" }
1947+
}
1948+
}
1949+
},
19221950
"advisories": {
19231951
"type": "array",
19241952
"title": "Advisories",

‎schema/bom-1.5.xsd‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2477,15 +2477,50 @@ limitations under the License.
24772477
<xs:element name="detail" type="xs:string" minOccurs="0" maxOccurs="1">
24782478
<xs:annotation>
24792479
<xs:documentation>If available, an in-depth description of the vulnerability as provided by the
2480-
source organization. Details often include examples, proof-of-concepts, and other information
2481-
useful in understanding root cause.</xs:documentation>
2480+
source organization. Details often include information useful in understanding root cause.</xs:documentation>
24822481
</xs:annotation>
24832482
</xs:element>
24842483
<xs:element name="recommendation" type="xs:string" minOccurs="0" maxOccurs="1">
24852484
<xs:annotation>
24862485
<xs:documentation>Recommendations of how the vulnerability can be remediated or mitigated.</xs:documentation>
24872486
</xs:annotation>
24882487
</xs:element>
2488+
<xs:element name="workaround" type="xs:string" minOccurs="0" maxOccurs="1">
2489+
<xs:annotation>
2490+
<xs:documentation>A bypass, usually temporary, of the vulnerability that reduces its likelihood and/or impact. Workarounds often involve changes to configuration or deployments.</xs:documentation>
2491+
</xs:annotation>
2492+
</xs:element>
2493+
<xs:element name="proofOfConcept" minOccurs="0" maxOccurs="1">
2494+
<xs:complexType>
2495+
<xs:annotation>
2496+
<xs:documentation xml:lang="en">
2497+
Evidence used to reproduce the vulnerability.
2498+
</xs:documentation>
2499+
</xs:annotation>
2500+
<xs:sequence>
2501+
<xs:element name="reproductionSteps" type="xs:string" minOccurs="0" maxOccurs="1">
2502+
<xs:annotation>
2503+
<xs:documentation>Precise steps to reproduce the vulnerability.</xs:documentation>
2504+
</xs:annotation>
2505+
</xs:element>
2506+
<xs:element name="environment" type="xs:string" minOccurs="0" maxOccurs="1">
2507+
<xs:annotation>
2508+
<xs:documentation>A description of the environment in which reproduction was possible.</xs:documentation>
2509+
</xs:annotation>
2510+
</xs:element>
2511+
<xs:element name="supportingMaterial" minOccurs="0" maxOccurs="1">
2512+
<xs:annotation>
2513+
<xs:documentation>Supporting material that helps in reproducing or understanding how reproduction is possible. This may include screenshots, payloads, and PoC exploit code.</xs:documentation>
2514+
</xs:annotation>
2515+
<xs:complexType>
2516+
<xs:sequence>
2517+
<xs:element name="attachment" type="bom:attachedTextType" minOccurs="0" maxOccurs="unbounded" />
2518+
</xs:sequence>
2519+
</xs:complexType>
2520+
</xs:element>
2521+
</xs:sequence>
2522+
</xs:complexType>
2523+
</xs:element>
24892524
<xs:element name="advisories" minOccurs="0" maxOccurs="1">
24902525
<xs:complexType>
24912526
<xs:annotation>

0 commit comments

Comments
 (0)