「网络安全常用术语解读」通用漏洞报告框架CVRF详解

作者：盐析白兔 | 2024-05-07 12:43:11

踩

1. 背景

ICASI在推进多供应商协调漏洞披露方面处于领先地位，引入了通用漏洞报告框架（Common Vulnerability Reporting Format，CVRF）标准，制定了统一安全事件响应计划（USIRP）的原则，帮助创建了多方漏洞协调和披露指南和实践，并建立了一个成功协调多供应商应对众多安全事件的行业领导者信托小组。为了继续取得这些成功，并确保全球社会更广泛的参与，ICASI（Industry Consortium for Advancement of Security on the Internet，互联网安全的行业促进联盟）将作为一个独立组织解散，并将其所有资产于2021年5月28日转移给了FIRST（Forum of Incident Response and Security Teams，事件响应和安全团队论坛）：

ICASI成立于2008年，旨在通过推动安全应对实践的卓越和创新来加强全球安全格局，促进成员之间的合作，以分析、缓解和解决多方利益相关者的全球安全挑战。这一角色将继续，但作为现有FIRST PSIRT SIG的一部分，扩展和提高社区应对多个供应商漏洞的能力。
FIRST成立于1990年，是全球安全事件响应的领导者。

在这里插入图片描述
截止目前，CVRF的治理已从ICASI过渡到结构化信息标准促进组织（Organization for the Advancement of Structured Information Standards，OASIS），并将更名为CSAF（通用安全能告框架）。

2. CVRF概览

通用漏洞报告框架（Common Vulnerability Reporting Format，CVRF）是以机器可读形式（XML文件）发布安全通告（Security Advisory，SA）的行业标准格式。安全通告包含漏洞严重等级、业务影响和修补方案等信息，用以传递漏洞修补方案。安全通告（SA）用于发布华为产品直接相关的严重（Critical）和高（High）等级的漏洞信息及修补方案。安全通告（SA）一般都会提供下载通用漏洞报告框架（CVRF）内容的选项，旨在以机器可读格式描述漏洞信息，以支持受影响客户的工具使用。

CVRF与OVAL格式不同，OVAL格式的目标是能够在安全性方面对系统的状态进行机器验证，而CVRF格式的目标则是基于机器导入票证系统和漏洞跟踪器以进行漏洞响应。

在这里插入图片描述

CVRF样例（CVE-2024-4340）

<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">CVE-2024-4340</DocumentTitle>
  <DocumentType>SUSE CVE</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE CVE-2024-4340</ID>
    </Identification>
    <Status>Interim</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>2</Number>
        <Date>2024-05-01T23:14:09Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2024-04-30T23:14:33Z</InitialReleaseDate>
    <CurrentReleaseDate>2024-05-01T23:14:09Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf-cve.pl</Engine>
      <Date>2020-12-27T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="CVE" Type="Summary" Ordinal="1" xml:lang="en">CVE-2024-4340</Note>
    <Note Title="Mitre CVE Description" Type="Description" Ordinal="2" xml:lang="en">Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="4" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="HPE Helion OpenStack 8">
      <Branch Type="Product Name" Name="HPE Helion OpenStack 8">
        <FullProductName ProductID="HPE Helion OpenStack 8" CPE="cpe:/o:suse:hpe-helion-openstack:8">HPE Helion OpenStack 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Enterprise Storage 7.1">
      <Branch Type="Product Name" Name="SUSE Enterprise Storage 7.1">
        <FullProductName ProductID="SUSE Enterprise Storage 7.1" CPE="cpe:/o:suse:ses:7.1">SUSE Enterprise Storage 7.1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Desktop 15 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP5" CPE="cpe:/o:suse:sle-module-basesystem:15:sp5">SUSE Linux Enterprise Module for Basesystem 15 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Desktop 15 SP6">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15 SP6">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP6" CPE="cpe:/o:suse:sle-module-basesystem:15:sp6">SUSE Linux Enterprise Module for Basesystem 15 SP6</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Python 3 15 SP6">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Python 3 15 SP6" CPE="cpe:/o:suse:sle-module-python3:15:sp6">SUSE Linux Enterprise Module for Python 3 15 SP6</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS" CPE="cpe:/o:suse:sle_hpc-ltss:15:sp2">SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS" CPE="cpe:/o:suse:sle_hpc-ltss:15:sp3">SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise High Performance Computing 15 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Public Cloud 15 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP4" CPE="cpe:/o:suse:sle-module-public-cloud:15:sp4">SUSE Linux Enterprise Module for Public Cloud 15 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS">
        <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS" CPE="cpe:/o:suse:sle_hpc-espos:15:sp4">SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS" CPE="cpe:/o:suse:sle_hpc-ltss:15:sp4">SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise High Performance Computing 15 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP5" CPE="cpe:/o:suse:sle-module-basesystem:15:sp5">SUSE Linux Enterprise Module for Basesystem 15 SP5</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Public Cloud 15 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP5" CPE="cpe:/o:suse:sle-module-public-cloud:15:sp5">SUSE Linux Enterprise Module for Public Cloud 15 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise High Performance Computing 15 SP6">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15 SP6">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP6" CPE="cpe:/o:suse:sle-module-basesystem:15:sp6">SUSE Linux Enterprise Module for Basesystem 15 SP6</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Python 3 15 SP6">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Python 3 15 SP6" CPE="cpe:/o:suse:sle-module-python3:15:sp6">SUSE Linux Enterprise Module for Python 3 15 SP6</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Package Hub 15 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Package Hub 15 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Package Hub 15 SP5" CPE="cpe:/o:suse:packagehub:15:sp5">SUSE Linux Enterprise Module for Package Hub 15 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Package Hub 15 SP6">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Package Hub 15 SP6">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Package Hub 15 SP6" CPE="cpe:/o:suse:packagehub:15:sp6">SUSE Linux Enterprise Module for Package Hub 15 SP6</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 15 SP1-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 15 SP1-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP1-LTSS" CPE="cpe:/o:suse:sles-ltss:15:sp1">SUSE Linux Enterprise Server 15 SP1-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 15 SP2-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 15 SP2-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP2-LTSS" CPE="cpe:/o:suse:sles-ltss:15:sp2">SUSE Linux Enterprise Server 15 SP2-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 15 SP3-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 15 SP3-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP3-LTSS" CPE="cpe:/o:suse:sles-ltss:15:sp3">SUSE Linux Enterprise Server 15 SP3-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 15 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Public Cloud 15 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP4" CPE="cpe:/o:suse:sle-module-public-cloud:15:sp4">SUSE Linux Enterprise Module for Public Cloud 15 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 15 SP4-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 15 SP4-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP4-LTSS" CPE="cpe:/o:suse:sles-ltss:15:sp4">SUSE Linux Enterprise Server 15 SP4-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 15 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP5" CPE="cpe:/o:suse:sle-module-basesystem:15:sp5">SUSE Linux Enterprise Module for Basesystem 15 SP5</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Public Cloud 15 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP5" CPE="cpe:/o:suse:sle-module-public-cloud:15:sp5">SUSE Linux Enterprise Module for Public Cloud 15 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 15 SP6">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15 SP6">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP6" CPE="cpe:/o:suse:sle-module-basesystem:15:sp6">SUSE Linux Enterprise Module for Basesystem 15 SP6</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Python 3 15 SP6">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Python 3 15 SP6" CPE="cpe:/o:suse:sle-module-python3:15:sp6">SUSE Linux Enterprise Module for Python 3 15 SP6</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 15 SP2">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 15 SP2">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15 SP2" CPE="cpe:/o:suse:sles_sap:15:sp2">SUSE Linux Enterprise Server for SAP Applications 15 SP2</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 15 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 15 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15 SP3" CPE="cpe:/o:suse:sles_sap:15:sp3">SUSE Linux Enterprise Server for SAP Applications 15 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 15 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Public Cloud 15 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP4" CPE="cpe:/o:suse:sle-module-public-cloud:15:sp4">SUSE Linux Enterprise Module for Public Cloud 15 SP4</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 15 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15 SP4" CPE="cpe:/o:suse:sles_sap:15:sp4">SUSE Linux Enterprise Server for SAP Applications 15 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 15 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP5" CPE="cpe:/o:suse:sle-module-basesystem:15:sp5">SUSE Linux Enterprise Module for Basesystem 15 SP5</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Public Cloud 15 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP5" CPE="cpe:/o:suse:sle-module-public-cloud:15:sp5">SUSE Linux Enterprise Module for Public Cloud 15 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 15 SP6">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15 SP6">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP6" CPE="cpe:/o:suse:sle-module-basesystem:15:sp6">SUSE Linux Enterprise Module for Basesystem 15 SP6</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Python 3 15 SP6">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Python 3 15 SP6" CPE="cpe:/o:suse:sle-module-python3:15:sp6">SUSE Linux Enterprise Module for Python 3 15 SP6</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Manager Proxy 4.3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Public Cloud 15 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP4" CPE="cpe:/o:suse:sle-module-public-cloud:15:sp4">SUSE Linux Enterprise Module for Public Cloud 15 SP4</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Manager Proxy 4.3">
        <FullProductName ProductID="SUSE Manager Proxy 4.3" CPE="cpe:/o:suse:suse-manager-proxy:4.3">SUSE Manager Proxy 4.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Manager Retail Branch Server 4.3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Public Cloud 15 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP4" CPE="cpe:/o:suse:sle-module-public-cloud:15:sp4">SUSE Linux Enterprise Module for Public Cloud 15 SP4</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Manager Retail Branch Server 4.3">
        <FullProductName ProductID="SUSE Manager Retail Branch Server 4.3" CPE="cpe:/o:suse:suse-manager-retail-branch-server:4.3">SUSE Manager Retail Branch Server 4.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Manager Server 4.3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Public Cloud 15 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP4" CPE="cpe:/o:suse:sle-module-public-cloud:15:sp4">SUSE Linux Enterprise Module for Public Cloud 15 SP4</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Manager Server 4.3">
        <FullProductName ProductID="SUSE Manager Server 4.3" CPE="cpe:/o:suse:suse-manager-server:4.3">SUSE Manager Server 4.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud 8">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud 8">
        <FullProductName ProductID="SUSE OpenStack Cloud 8" CPE="cpe:/o:suse:suse-openstack-cloud:8">SUSE OpenStack Cloud 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud 9">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud 9">
        <FullProductName ProductID="SUSE OpenStack Cloud 9" CPE="cpe:/o:suse:suse-openstack-cloud:9">SUSE OpenStack Cloud 9</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud Crowbar 8">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud Crowbar 8">
        <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 8" CPE="cpe:/o:suse:suse-openstack-cloud-crowbar:8">SUSE OpenStack Cloud Crowbar 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud Crowbar 9">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud Crowbar 9">
        <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 9" CPE="cpe:/o:suse:suse-openstack-cloud-crowbar:9">SUSE OpenStack Cloud Crowbar 9</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 15.5">
      <Branch Type="Product Name" Name="openSUSE Leap 15.5">
        <FullProductName ProductID="openSUSE Leap 15.5" CPE="cpe:/o:opensuse:leap:15.5">openSUSE Leap 15.5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 15.6">
      <Branch Type="Product Name" Name="openSUSE Leap 15.6">
        <FullProductName ProductID="openSUSE Leap 15.6" CPE="cpe:/o:opensuse:leap:15.6">openSUSE Leap 15.6</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="python-sqlparse">
      <FullProductName ProductID="python-sqlparse" CPE="cpe:2.3:a:sqlparse_project:sqlparse:*:*:*:*:*:*:*:*">python-sqlparse</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python2-sqlparse">
      <FullProductName ProductID="python2-sqlparse">python2-sqlparse</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python3-sqlparse">
      <FullProductName ProductID="python3-sqlparse">python3-sqlparse</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python311-sqlparse">
      <FullProductName ProductID="python311-sqlparse">python311-sqlparse</FullProductName>
    </Branch>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="HPE Helion OpenStack 8">
      <FullProductName ProductID="HPE Helion OpenStack 8:python-sqlparse">python-sqlparse as a component of HPE Helion OpenStack 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 7.1">
      <FullProductName ProductID="SUSE Enterprise Storage 7.1:python3-sqlparse">python3-sqlparse as a component of SUSE Enterprise Storage 7.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:python-sqlparse">python-sqlparse as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP5:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP6">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP6:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6</FullProductName>
    </Relationship>
    <Relationship ProductReference="python2-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Package Hub 15 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Package Hub 15 SP5:python2-sqlparse">python2-sqlparse as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Package Hub 15 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Package Hub 15 SP5:python-sqlparse">python-sqlparse as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Package Hub 15 SP6">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Package Hub 15 SP6:python-sqlparse">python-sqlparse as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6</FullProductName>
    </Relationship>
    <Relationship ProductReference="python311-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Public Cloud 15 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-sqlparse">python311-sqlparse as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Public Cloud 15 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP4:python-sqlparse">python-sqlparse as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="python311-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Public Cloud 15 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP5:python311-sqlparse">python311-sqlparse as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Public Cloud 15 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Public Cloud 15 SP5:python-sqlparse">python-sqlparse as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Python 3 15 SP6">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Python 3 15 SP6:python-sqlparse">python-sqlparse as a component of SUSE Linux Enterprise Module for Python 3 15 SP6</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP1-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP1-LTSS:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise Server 15 SP1-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP1-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP1-LTSS:python-sqlparse">python-sqlparse as a component of SUSE Linux Enterprise Server 15 SP1-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP2-LTSS:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise Server 15 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP2-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP2-LTSS:python-sqlparse">python-sqlparse as a component of SUSE Linux Enterprise Server 15 SP2-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP3-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP3-LTSS:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise Server 15 SP3-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP4-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP4-LTSS:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise Server 15 SP4-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 15 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15 SP2:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 15 SP2">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15 SP2:python-sqlparse">python-sqlparse as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15 SP3:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 15 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15 SP4:python3-sqlparse">python3-sqlparse as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Manager Proxy 4.3">
      <FullProductName ProductID="SUSE Manager Proxy 4.3:python3-sqlparse">python3-sqlparse as a component of SUSE Manager Proxy 4.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Manager Retail Branch Server 4.3">
      <FullProductName ProductID="SUSE Manager Retail Branch Server 4.3:python3-sqlparse">python3-sqlparse as a component of SUSE Manager Retail Branch Server 4.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE Manager Server 4.3">
      <FullProductName ProductID="SUSE Manager Server 4.3:python3-sqlparse">python3-sqlparse as a component of SUSE Manager Server 4.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 8">
      <FullProductName ProductID="SUSE OpenStack Cloud 8:python-sqlparse">python-sqlparse as a component of SUSE OpenStack Cloud 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 9">
      <FullProductName ProductID="SUSE OpenStack Cloud 9:python-sqlparse">python-sqlparse as a component of SUSE OpenStack Cloud 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 8">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 8:python-sqlparse">python-sqlparse as a component of SUSE OpenStack Cloud Crowbar 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 9">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 9:python-sqlparse">python-sqlparse as a component of SUSE OpenStack Cloud Crowbar 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.5">
      <FullProductName ProductID="openSUSE Leap 15.5:python-sqlparse">python-sqlparse as a component of openSUSE Leap 15.5</FullProductName>
    </Relationship>
    <Relationship ProductReference="python3-sqlparse" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.5">
      <FullProductName ProductID="openSUSE Leap 15.5:python3-sqlparse">python3-sqlparse as a component of openSUSE Leap 15.5</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-sqlparse" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.6">
      <FullProductName ProductID="openSUSE Leap 15.6:python-sqlparse">python-sqlparse as a component of openSUSE Leap 15.6</FullProductName>
    </Relationship>
  </ProductTree>
  <Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

</Note>
    </Notes>
    <CVE>CVE-2024-4340</CVE>
    <ProductStatuses>
      <Status Type="Known Affected">
        <ProductID>HPE Helion OpenStack 8:python-sqlparse</ProductID>
        <ProductID>SUSE Enterprise Storage 7.1:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:python-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP5:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP6:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Package Hub 15 SP5:python-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Package Hub 15 SP5:python2-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Package Hub 15 SP6:python-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Public Cloud 15 SP4:python-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Public Cloud 15 SP5:python-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Public Cloud 15 SP5:python311-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Python 3 15 SP6:python-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:python-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP2-LTSS:python-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP2-LTSS:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP3-LTSS:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP4-LTSS:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP2:python-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP2:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP3:python3-sqlparse</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP4:python3-sqlparse</ProductID>
        <ProductID>SUSE Manager Proxy 4.3:python3-sqlparse</ProductID>
        <ProductID>SUSE Manager Retail Branch Server 4.3:python3-sqlparse</ProductID>
        <ProductID>SUSE Manager Server 4.3:python3-sqlparse</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:python-sqlparse</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:python-sqlparse</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 8:python-sqlparse</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:python-sqlparse</ProductID>
        <ProductID>openSUSE Leap 15.5:python-sqlparse</ProductID>
        <ProductID>openSUSE Leap 15.5:python3-sqlparse</ProductID>
        <ProductID>openSUSE Leap 15.6:python-sqlparse</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
  </Vulnerability>
</cvrfdoc>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431

3. CVRF主要内容

在这里插入图片描述
CVRF一级节点有11个，具体如下：

Title（标题）: cvrf:DocumentTitle
Type（类型）: cvrf:DocumentType
Publisher（发布者）: cvrf:DocumentPublisher
Tracking（跟踪）: cvrf:DocumentTracking
Notes（注释）: cvrf:DocumentNotes
Distribution（分发）: cvrf:DocumentDistribution
Aggregate Severity（严重级别）: cvrf:AggregateSeverity
References（参考）: cvrf:DocumentReferences
Acknowledgements（致谢）: cvrf:Acknowledgements
Product Tree（产品树）: prod:ProductTree
Vulnerability（漏洞）: vuln:Vulnerability

关于CVRF的文档的详细介绍可以参阅如下官方文档：

pcsaf-cvrf-v1.2-cs01.pdf (访问密码: 6277)

4. CSAF是CVRF的替代品吗？

答案是肯定的。CSAF是通用漏洞报告框架（CVRF）的替代品，它增强了CVRF的能力，包括不同的配置文件（例如，CSAF基础、信息咨询、事件响应、VEX等）。每个配置文件通过强制使用标准中的其他字段，直接或间接地通过标准中的另一个配置文件扩展基本配置文件“CSAF基本”。概要文件总是可以添加，但决不能减去或覆盖其扩展的概要文件中定义的需求。CSAF还提供了CVRF不支持的几个附加增强功能。此外，CSAF使用JSON，而CVRF使用XML。

CVRF文件可以转换为CSAF，它将 CVRF 文档作为输入并将其转换为有效的 CSAF 文档。

5. 参考

[1] https://github.com/oasis-tcs/csaf/tree/master/cvrf_1.2
[2] https://oasis-open.github.io/csaf-documentation/
[3] https://www.suse.com/zh-cn/support/security/cvrf/
[4] https://www.redhat.com/zh/blog/csaf-vex-documents-now-generally-available
[5] https://ftp.suse.com/pub/projects/security/cvrf-cve/

推荐阅读：

在这里插入图片描述

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/盐析白兔/article/detail/549307

「 网络安全常用术语解读 」通用漏洞报告框架CVRF详解

1. 背景

2. CVRF概览

3. CVRF主要内容

4. CSAF是CVRF的替代品吗？

5. 参考

「网络安全常用术语解读」通用漏洞报告框架CVRF详解