Kubernetes and Cloud Native Security Associate (KCSA) free question 10 / 10 · Domain 6: Compliance and Security Frameworks
A vendor's product contains a library with a known CVE, but the vulnerable code is never used by the product. Customers keep raising the finding. What does the CNCF Software Supply Chain Best Practices paper (v2) describe for communicating this?
- A signed attestation that the CVE was fixed, even though the library was not changed.
- Remove the library from the SBOM, so that customers no longer see the component in it.
- Nothing, since an SBOM already says for each package whether it is vulnerable or not.
- A VEX document that gives the state of the vulnerability, for example NOT AFFECTED.
Show the answer and explanation
Answer: D
Why this is correct
The paper describes VEX as follows: "The generation of Vulnerability Exploitability eXchange (VEX) documents for software artifacts is a proactive measure to communicate the exploitability of vulnerabilities within specific environments. During this process, it is possible to include a parameter describing the state of given vulnerabilities present in the report (AFFECTED, NOT AFFECTED, UNDER INVESTIGATION, FIXED)." It mentions this very case: "there might be false positives or trails of unused libraries. Those need to be listed inside the report, and specifying the status could help evaluating the actual security impact." VEX documents are typically JSON or XML, and a CycloneDX SBOM can reference a separate VEX document or embed vulnerability details. The paper adds that "VEX is not yet widely adopted, however it is a useful tool to consider when producing SBOMs and consuming artifacts."
Why the other options are wrong
"Remove the library from the SBOM, so that customers no longer see the component in it." … An SBOM is meant to be "a detailed inventory of all components, libraries, and dependencies used in a software application". Hiding a component makes the inventory wrong.
"A signed attestation that the CVE was fixed, even though the library was not changed." … Attestations are "signed records of actions that occurred in the software supply chain." A record of a fix that did not happen would be false; the paper's VEX states include FIXED only for real fixes.
"Nothing, since an SBOM already says for each package whether it is vulnerable or not." … The paper says SBOMs "do not include vulnerability information about the package itself."
Say whether the CVE matters here
An SBOM lists components but not their vulnerability status. A VEX document states, per vulnerability, AFFECTED, NOT AFFECTED, UNDER INVESTIGATION or FIXED in a given context.