Download the PHP package mteu/advisory-assessor without Composer
On this page you can find all versions of the php package mteu/advisory-assessor. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download mteu/advisory-assessor
More information about mteu/advisory-assessor
Files in mteu/advisory-assessor
Package advisory-assessor
Short Description PHP library for recording triage decisions on security advisory findings as VEX statements
License MIT
Homepage https://github.com/mteu/advisory-assessor
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package advisory-assessor
PHP library that records what a developer found after looking at an advisory match
(e.g. through mteu/advisory-matcher),
as an exportable Vulnerability Exploitability eXchange (VEX) statement, and
decides which findings an assessment still covers. This library holds the answer
you give back to that advisory: not affected, a false positive, affected and
accepted, fixed, or under investigation.
[!WARNING] This project is not yet intended for production use. The API may change without notice.
🚀 Features
- Assessments in the VEX sense, with CycloneDX's justification vocabulary. Each assessment carries what CISA's Minimum Requirements for VEX ask of a statement, and each written document what they ask of a document: an ID, a version, an author and an issue time.
- One rule for whether an assessment still covers a finding, shared by every consumer:
AssessmentMatcher::resolve()for a finding and every assessment,AssessmentMatcher::covers()for one pair - Components named by package URL at one exact version, as the
matcher's
PackageRef, so an advisory and a component name a package the same way - CycloneDX 1.6 VEX documents, written from their input alone and in a stable order, so they diff cleanly in a repository
- One assessment as a CycloneDX vulnerability object, to paste into a VEX a project keeps in its repository
- CycloneDX 1.4 to 1.7 VEX documents read back into assessments, parsed with
mteu/sbom-parser. If any entry is unclear, the whole document is rejected and every bad entry is named with aRejectionReason.
[!NOTE] What VEX and CISA call a "statement" is an
Assessmentin this library. AFindingis the raw advisory match, and anAssessmentis what a person concludes about it. The CycloneDX reader and writer map between the two.
⚡️ Installation
You also need a PSR-20 clock implementation, such as symfony/clock.
💡 Usage
Writing CycloneDX VEX
Reading CycloneDX VEX
📝 Things to know
- An assessment covers a finding only while it has not expired, the component keeps the version it names, and the advisory still answers to one of its identities.
- When several assessments cover one finding, the most alarming decides. A newer assessment does not replace an older one, so retire the old one.
- Store the identities from
AdvisoryFingerprint::identitiesOf(), not only the canonical fingerprint. - Reasons are free text that someone typed. Escape them before you show them.
- The reader rejects a whole document if any entry is unclear. The finding then stays visible.
- Cap the size of a document before you read it.
Details are in CycloneDX VEX.
📙 Documentation
- Public API reference: the supported types. Everything else is
@internal. - Matching assessments to findings
- CycloneDX VEX
🤝 Contributing
See CONTRIBUTING.md for the workflow.
🔒 Security
Report vulnerabilities as described in the Security Policy.
⭐ License
This package is licensed under MIT.
💬 Support
Issues and feature requests go to the GitHub issue tracker.
All versions of advisory-assessor with dependencies
mteu/advisory-matcher Version ^0.2
mteu/sbom-parser Version ^0.6
psr/clock Version ^1.0