hard20 pts · first answer countsdevsecopssbomvulnerability-management

Answering a customer scan with VEX

A customer's scanner flags a CVE in a library inside your product. You have confirmed the vulnerable code is never loaded. What lets you state this in a machine-readable way?

A.A second SBOM with the library removed from the listB.A PDF letter from your CTOC.A CVSS score lowered to 0.0 in your reportD.A VEX document marking the CVE not_affected with a justification

Discussion 0

Join free to post in the discussion.

Answering a customer scan with VEX

Discussion 0

Related questions