Assess a vulnerability (VEX)

An assessment records what a vulnerability means for your product, in the VEX vocabulary that tools and customers understand. It is your decision: Provetry keeps it, signs it into the evidence journal and, if you open a public page, lists not affected and fixed assessments in its VEX feed (your explanations stay private).

1. On the vulnerability, click Change the assessment.
2. Choose the status:
   • Not affected, with the reason: the component is not in the product, the vulnerable code is not in the product, the vulnerable code is never run, an attacker cannot reach it, or mitigations are already in place;
   • Affected, with the action statement: what users must do, or what you will ship;
   • Fixed;
   • Under investigation.
3. Add the impact statement in your words, then Save the assessment.

Why it matters

• The same decision does not need to be made twice: it carries over to the next releases that contain the same component.
• If a later release contradicts it (a vulnerability you said is never run is now called by your code), Provetry flags it.
• Downloads of the release include an OpenVEX document with your assessments.