What is VEX

VEX and connection to vulnerability reports.

VEX (Vulnerability Exploitability eXchange) is a document format that allows vendors and operators to indicate whether a specific vulnerability (CVE)** is applicable in a given product, component, or image. The goal is to reduce noise in scan reports: not all CVEs found are actually exploitable in your context (package version used, disabled feature, sandbox, etc.).

The VEX document links the artifact (for example, container image), vulnerability (CVE identifier) ​​and applicability status (affected / not_affected / fixed, etc.), optionally with justification. This helps:

  • focus on really applicable vulnerabilities;
  • reasonably exclude false positives in reports and policies (for example, “banning pods with critical vulnerabilities” taking into account VEX).

The VEX specification is developed within CISA and is associated with SBOM (Software Bill of Materials) formats. VEX support in scanning tools (including Trivy) allows such documents to be taken into account when generating reports and filtering vulnerabilities.

Use in the Shturval platform

In the platform, image scanning is performed based on Trivy (Container Image Scanning Module, shturval-scanner). Tagged vulnerabilities (including using VEX or internal tagging procedures) can be excluded from the report or marked as not applicable, so that only truly applicable vulnerabilities are taken into account in the GUI and when applying policies (for example, blocking pods with critical CVEs). The exact mechanism (VEX format, storage, integration with Trivy) depends on the platform version and is described in the documentation for tagged vulnerabilities and the image scanning module.

Additional

← How to update the vulnerability database in a closed loop
Modifying Policies →