The safeguards map / 4.4 Disclosure and advisories
vexctl
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A command-line tool from the OpenVEX project that creates, merges, attests and applies VEX statements saying a known vulnerability does not affect a product.
Where it sits
4.4 Disclosure and advisories (primary): Creates VEX documents stating whether a vulnerability affects a product, merges documents from several issuers, wraps them in signed attestations and applies them to scanner results.
is a tool to create, apply, and attest VEX (Vulnerability Exploitability eXchange) data
captured
vexctl can merge the documents to get the most up-to-date impact assessment of a vulnerability
captured
Applying the VEX data to scanner result
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who make itthose who distribute it
- Runs
- by hand
Handoffs
produces Vulnerability status: OpenVEX
Collector's note
The OpenVEX specification itself is a handoff artifact, not an entry. The OpenSSF table lists the OpenVEX project, whose GitHub organization hosts vexctl.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.