Untuk setiap image container yang dikirim ke Artifact Registry, Artifact Analysis dapat menyimpan pernyataan VEX terkait. VEX adalah jenis saran keamanan yang menunjukkan apakah suatu produk terpengaruh oleh kerentanan yang diketahui.
Setiap pernyataan memberikan:
Penerbit Pernyataan VEX
Artefak yang pernyataan ini dibuat untuknya
Penilaian kerentanan (status VEX) untuk kerentanan yang diketahui
Penerbit software dapat membuat pernyataan VEX untuk menjelaskan postur keamanan aplikasi. Pernyataan VEX mencatat kerentanan apa pun yang ditemukan dalam artefak tertentu dan memberikan konteks tentang dampaknya terhadap pelanggan atau badan pengatur.
Penegak keamanan dan kebijakan dapat menggunakan status VEX untuk memilah risiko dalam rantai pasokan software mereka dan menggunakan pernyataan VEX untuk membuktikan komposisi artefak mereka guna membantu organisasi memenuhi persyaratan peraturan.
Status VEX
Status VEX menunjukkan apakah artefak terpengaruh oleh kerentanan yang diketahui.
Statusnya dapat berupa salah satu dari:
Tidak terpengaruh: Tidak ada perbaikan yang diperlukan terkait kerentanan ini.
Terpengaruh: Tindakan perbaikan direkomendasikan.
Diperbaiki: Dalam versi produk ini, perbaikan telah diterapkan untuk mengatasi kerentanan.
Dalam Penyelidikan: Status produk ini belum ditentukan.
Penayang akan memberikan status yang diperbarui dalam rilis selanjutnya.
Untuk mendapatkan izin yang Anda perlukan untuk mengupload penilaian VEX dan memeriksa status VEX kerentanan,
minta administrator Anda untuk memberi Anda
peran IAM berikut pada project:
PRODUCT_NAME Nama produk yang dapat dibaca manusia untuk gambar.
Mengambil nilai string. Nilainya harus berupa nama kanonis lengkap produk, termasuk nomor versi dan atribut lainnya.
LOCATION adalah lokasi regional atau multi-regional repositori Anda.
PROJECT_ID adalah ID untuk project yang berisi
repositori Anda.
REPO_NAME adalah nama repositori Docker Anda di Artifact Registry.
IMAGE_NAME adalah nama gambar.
CVE_ID adalah ID untuk kerentanan, seperti
CVE-2017-11164.
PRODUCT_STATUS adalah penilaian risiko keamanan.
Analisis Artefak mendukung empat jenis status: known_affected,
known_not_affected, under_investigation, dan fixed.
Untuk setiap kerentanan yang ingin Anda cantumkan dalam pernyataan VEX, Anda harus
membuat cabang cve dan menentukan nilai product_status.
Nilai kolom name di product_tree.branches.name adalah URI
gambar. Menyertakan nilai ini mengaitkan pernyataan VEX dengan image Docker
tertentu.
Langkah berikutnya
Upload pernyataan VEX pernyataan VEX yang ada atau pernyataan VEX
yang diberikan oleh penerbit lain.
Memprioritaskan masalah kerentanan menggunakan VEX. Pelajari cara
melihat pernyataan VEX dan memfilter kerentanan menurut status VEX.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-02 UTC."],[[["\u003cp\u003eVEX (Vulnerability Exploitability eXchange) statements are security advisories that indicate whether a product is affected by a known vulnerability, and Artifact Analysis can store them for container images in Artifact Registry.\u003c/p\u003e\n"],["\u003cp\u003eVEX statements detail the publisher, the artifact, and the vulnerability assessment, providing context about the impact of any vulnerabilities discovered.\u003c/p\u003e\n"],["\u003cp\u003eVEX status options include "Not affected," "Affected," "Fixed," and "Under Investigation," each offering different guidance on the need for remediation.\u003c/p\u003e\n"],["\u003cp\u003eCreating VEX statements requires the use of the CSAF (Common Security Advisory Format) 2.0 standard in JSON and defining the \u003ccode\u003eproduct_status\u003c/code\u003e for each CVE (Common Vulnerabilities and Exposures) branch.\u003c/p\u003e\n"],["\u003cp\u003eTo begin, you must have container images stored in an Artifact Registry repository and possess the necessary IAM roles, such as Container Analysis Notes Editor, to create and update notes.\u003c/p\u003e\n"]]],[],null,["# Create VEX statements\n\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis document describes how to create\n[Vulnerability Exploitability eXchange (VEX)](https://www.cisa.gov/sites/default/files/2023-04/minimum-requirements-for-vex-508c.pdf) statements.\n\nFor every container image pushed to Artifact Registry, Artifact Analysis can\nstore an associated VEX statement. VEX is a type of security advisory that\nindicates whether a product is affected by a known vulnerability.\n\nEach statement provides:\n\n- The publisher of the VEX Statement\n- The artifact for which the statement is written\n- The vulnerability assessment (VEX status) for any known vulnerabilities\n\nSoftware publishers can create VEX statements to describe the security posture\nof an application. VEX statements note any vulnerabilities discovered in\nspecific artifacts and provide context about their impact to their customers or\nregulatory bodies.\n\nSecurity and policy enforcers can use VEX status to triage risks in\ntheir software supply chains and use VEX statements to attest to the composition\nof their artifacts to help organizations meet regulatory requirements.\n\nVEX status\n----------\n\nThe VEX status indicates whether an artifact is affected by a known\nvulnerability.\n\nThe status can be one of:\n\n- **Not affected**: No remediation is required regarding this vulnerability.\n- **Affected**: Remediation actions are recommended.\n- **Fixed**: In this version of the product, a fix has been applied to address the vulnerability.\n- **Under Investigation**: The status of this product is yet to be determined. The publisher will provide an updated status in a later release.\n\nBefore you begin\n----------------\n\n- [Sign in](https://accounts.google.com/Login) to your Google Account.\n\n If you don't already have one, [sign up for a new account](https://accounts.google.com/SignUp).\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Container Analysis, Artifact Registry APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=https://containeranalysis.googleapis.com, https://artifactregistry.googleapis.com)\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n | **Note:** If you installed the gcloud CLI previously, make sure you have the latest version by running `gcloud components update`.\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Container Analysis, Artifact Registry APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=https://containeranalysis.googleapis.com, https://artifactregistry.googleapis.com)\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n | **Note:** If you installed the gcloud CLI previously, make sure you have the latest version by running `gcloud components update`.\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n1. Have container images stored in an Artifact Registry repository, or [create a repository](/artifact-registry/docs/repositories/create-repos) and [push your images](/artifact-registry/docs/docker/pushing-and-pulling).\n\n\u003cbr /\u003e\n\nRequired roles\n--------------\n\n\nTo get the permissions that\nyou need to upload VEX assessments and check the VEX status of vulnerabilities,\n\nask your administrator to grant you the\nfollowing IAM roles on the project:\n\n- To create and update notes: [Container Analysis Notes Editor](/iam/docs/roles-permissions/containeranalysis#containeranalysis.notes.editor) (`roles/containeranalysis.notes.editor`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nCreate VEX statements\n---------------------\n\nArtifact Analysis supports the\n[Common Security Advisory Format (CSAF)](https://oasis-open.github.io/csaf-documentation/) 2.0 standard in JSON. To\nproduce a new VEX statement, use the [CSAF schema](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/json_schema/csaf_json_schema.json).\n\nThe following is an example of a VEX statement for an image in Artifact Registry\nwith one `cve` branch for a known vulnerability.\n\nYou must define the value of the `product_status` for each CVE. \n\n\n {\n \"document\": {\n \"csaf_version\": \"2.0\",\n \"lang\": \"en-US\",\n \"publisher\": {\n \"name\": \"Sample-Company\",\n \"namespace\": \"https://sample-company.com\"\n },\n \"title\": \"Vex document 1.1\"\n },\n \"product_tree\": {\n \"branches\": [\n {\n \"name\": \"https://\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e-docker.pkg.dev/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/\u003cvar translate=\"no\"\u003eREPO_NAME\u003c/var\u003e/\u003cvar translate=\"no\"\u003eIMAGE_NAME\u003c/var\u003e\",\n \"product\": {\n \"name\": \"\u003cvar translate=\"no\"\u003ePRODUCT_NAME\u003c/var\u003e\",\n \"product_id\": \"\u003cvar translate=\"no\"\u003eIMAGE_NAME\u003c/var\u003e\"\n }\n }\n ]\n },\n \"vulnerabilities\": [\n {\n \"cve\": \"\u003cvar translate=\"no\"\u003eCVE_ID\u003c/var\u003e\",\n \"product_status\": {\n \"\u003cvar translate=\"no\"\u003ePRODUCT_STATUS\u003c/var\u003e\": [\n \"\u003cvar translate=\"no\"\u003eIMAGE_NAME\u003c/var\u003e\"\n ]\n }\n }\n ]\n }\n\nWhere\n\n- \u003cvar translate=\"no\"\u003ePRODUCT_NAME\u003c/var\u003e Human-readable product name for the image. Takes a string value. The value should be the product's full canonical name, including version number and other attributes.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e is the region or multi-regional location of your repository.\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the ID for the project that contains your repository.\n- \u003cvar translate=\"no\"\u003eREPO_NAME\u003c/var\u003e is the name of your Docker repository in Artifact Registry.\n- \u003cvar translate=\"no\"\u003eIMAGE_NAME\u003c/var\u003e is the name of the image.\n- \u003cvar translate=\"no\"\u003eCVE_ID\u003c/var\u003e is the identifier for the vulnerability, such as `CVE-2017-11164`.\n- \u003cvar translate=\"no\"\u003ePRODUCT_STATUS\u003c/var\u003e is the assessment of the security risk. Artifact Analysis supports four status types: `known_affected`, `known_not_affected`, `under_investigation`, and `fixed`.\n\nFor each vulnerability that you want to list in your VEX statement, you must\ncreate a `cve` branch and define the value of the `product_status`.\n\nThe value of the `name` field in `product_tree.branches.name` is the image\nURI. Including this value associates the VEX statement to a specific Docker\nimage.\n\nWhat's next\n-----------\n\n- [Upload VEX statements](/artifact-analysis/docs/upload-vex) your existing VEX statements or VEX statements provided by other publishers.\n- Prioritize vulnerability issues using VEX. Learn how to [view VEX statements](/artifact-analysis/docs/view-vex) and filter vulnerabilities by VEX status."]]
