The Bugs Framework data format, OSV, and JSON-LD

[Josh Bressers]

Hi all,

I'm CCing Irena Bojanova to this mail, she is leading a group at NIST on a project called Bugs Framework Project (BF).

https://samate.nist.gov/BF/

I've been reading some of their work, I like it. I would encourage everyone subscribed to this list to take a look. The data format is incomplete, but being worked on.

This mail is to kill a few birds with one stone.

I put together a file that shows off what I envision adding BF data could look like here

https://github.com/joshbressers/uvi-tools/blob/json-ld/json-ld/UVI-2014-0160.jsonld

I do not have a JSON-LD context definition yet.

I used Heartbleed as my example because the BF folks have a nice writeup about it here

https://samate.nist.gov/BF/Examples/MUS.html

I am too stupid and lazy to figure out a bug in a reasonable amount of time so I cheated.

Second, everything in that file should conform to the OSV schema (I can't find an actual schema definition to validate, so I can't prove it). I think we can use the current OSV format with a few minor changes to properly support JSON-LD.

Lastly, the BF data format is very descriptive, but I like JSON and wanted to see it described as such, so that's what this file is really meant to show off. I had a chat with Irena and promised such an example this weekend. OSV compatibility was a happy accident.

If we have BF data and a git commit, I believe we could auto generate the description and severity score for most any bug or vulnerability. I need to think about this more though.

Feedback is welcome, thanks in advance.

--

     Josh

[Oliver Chang]

Thanks for sharing this Josh! This looks really interesting. 

Re OSV schema validator, we have a pull request with a JSON schema definition here: https://github.com/ossf/osv-schema/pull/5 

--

Oliver

--
You received this message because you are subscribed to the Google Groups "UVI Discussion Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to uvi+uns...@groups.cloudsecurityalliance.org.

[Bojanova, Irena V. (Fed)]

Josh and Oliver,

Please see here (https://drive.google.com/drive/folders/1-QwRneiJNW0bLSIAXpYZw8OgOv3bG1uP) an updated BF Hearbleed description in XML format. (The schema only for the BF class definition is defined for now. I will have the vulnerability descriptions schema soon.)

I did this in XML, as I use XSLT and XPath to generate visualizations. It should be easily to translate this to JSON.

Please let me know what you think.

Irena

---

From: Oliver Chang <och...@google.com>
Sent: Monday, September 13, 2021 2:38 AM
To: Josh Bressers <jo...@bress.net>
Cc: Bojanova, Irena V. (Fed) <irena.b...@nist.gov>; u...@groups.cloudsecurityalliance.org <u...@groups.cloudsecurityalliance.org>
Subject: Re: The Bugs Framework data format, OSV, and JSON-LD

 

[Kurt Seifried]

Can you make this document public? Thanks.

Kurt Seifried (He/Him) Chief Blockchain Officer and Director of Special Projects Cloud Security Alliance e: ksei...@cloudsecurityalliance.org

[Kurt Seifried]

Took a quick look at:

https://drive.google.com/drive/folders/1-QwRneiJNW0bLSIAXpYZw8OgOv3bG1uP

Question: the definitions of words e.g.:

    <Value>Under Bounds</Value>
<Value>Untrusted Pointer</Value>
<Value>Wrong Position</Value>
<Value>Casted Pointer</Value>

are from CWE, or?

Kurt Seifried (He/Him) Chief Blockchain Officer and Director of Special Projects Cloud Security Alliance e: ksei...@cloudsecurityalliance.org

On Sun, Oct 3, 2021 at 10:19 PM Bojanova, Irena V. (Fed) <irena.b...@nist.gov> wrote:

Kurt,

I will share it with you. It's on the NIST Drive, so it cannot be made public.

I will put the files on GitHub once we double-check them.

Irena

---

From: Kurt Seifried <ksei...@cloudsecurityalliance.org>
Sent: Monday, October 4, 2021 12:00 AM
To: Bojanova, Irena V. (Fed) <irena.b...@nist.gov>
Cc: Oliver Chang <och...@google.com>; Josh Bressers <jo...@bress.net>; u...@groups.cloudsecurityalliance.org <u...@groups.cloudsecurityalliance.org>

This e-mail account is used only for work-related purposes; it is not guaranteed that any correspondence sent to this address will be read by the addressee only, as it may be necessary, under certain circumstances, for third parties appointed by the Cloud Security Alliance to access this e-mail account. Please do not send any messages of a personal nature to this address.