docs: add CVE applicability evidence gates#1364
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2f16f68fde
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| 1. Check the CVE record status from NVD and the CVE List when available. | ||
| 2. If the record is `Rejected`/`REJECTED`, do not assign an SLA to that CVE ID. Treat it as invalid unless a replacement CVE is named in the rejection reason. | ||
| 3. If the record is `Disputed`, `Modified`, `Deferred`, or `Undergoing Analysis`, require authoritative evidence before escalation: vendor advisory, CNA statement, affected-version table, VEX/CSAF status, or distro security tracker entry. |
There was a problem hiding this comment.
When the NVD API returns Modified, this instruction treats the CVE like a disputed or incomplete record and requires extra authoritative evidence before escalation. The NVD status reference linked by this file defines Modified as a post-enrichment update, not an applicability dispute, so valid high-risk CVEs that are merely updated after analysis can be held out of Immediate/Out-of-Cycle handling unless separate vendor evidence is available. Reserve this gate for disputed/deferred/awaiting/undergoing-analysis signals, or record Modified without blocking escalation.
Useful? React with 👍 / 👎.
| ``` | ||
| CVE Status and Applicability: | ||
| - CVE Record Status: [Published | Modified | Rejected | Disputed | Reserved | Deferred | Unknown] | ||
| - NVD API Status: [Analyzed | Modified | Rejected | Deferred | Awaiting Analysis | Unknown] |
There was a problem hiding this comment.
The NVD API status set includes Received and UndergoingAnalysis, but this output template omits both, even though Step 1A specifically gates Undergoing Analysis. For newly published or actively enriched CVEs, the agent has to report Unknown instead of the actual NVD status, which loses the evidence explaining why an SLA was held or escalated. Add those statuses here and in the final report table so the applicability decision remains traceable.
Useful? React with 👍 / 👎.
1 participant
Summary
Created from review issue
Fixes #1328
What was wrong
Scanner severity and CPE matches could be converted into emergency remediation SLAs before confirming whether the CVE record is usable, disputed/rejected, or applicable to the installed product/package. This can over-prioritize false positives such as rejected IDs, vendor not affected advisories, fixed distro backports, or optional code paths that are not present.
What changed
skills/vuln-management/cve-triage/tests/disputed-applicability-edge-cases.md.Validation
git diff --check