Improved security practices

Oct 13, 2025 by wbrum.org 42 views

Easier way to connect between OSV advisories and other metadata (e.g. CWEs, CVSS, EPSS, CISA KEV)

Connecting the Dots: Enhancing OSV Advisories with Additional Metadata

In the world of software security, having access to accurate and comprehensive vulnerability data is crucial for organizations to make informed decisions about their security posture. OSV.dev, a leading provider of vulnerability data, aggregates feeds from various sources to provide users with a unified view of vulnerabilities. However, there are instances where additional metadata, such as CWEs, CVSS, EPSS, and CISA KEV, may not be readily available or may not make sense to include in a specific home database. In this article, we will explore an easier way for users of OSV.dev to aggregate and collect this metadata for advisories.

The Challenge of Aggregating Metadata

OSV.dev aggregates feeds from different sources, which may or may not include additional metadata. This can lead to inconsistencies and gaps in the data, making it challenging for users to get a complete picture of vulnerabilities. For instance, EPSS data comes from a single authoritative entity, first.org, rather than the home database. This can make it difficult for users to access and utilize this valuable information.

Unlocking the Power of Metadata

Most OSV advisories are linked to a CVE ID, which provides a starting point for aggregating additional metadata. By consulting the NVD/CVE List, users can access CVSS and CWE information. Similarly, users can consult the first.org EPSS data and CISA KEV to gather more insights. This metadata can be used to enhance the security posture of an organization, inform risk-based decisions, and improve overall security practices.

Exploring Possibilities

There are several possibilities for aggregating and collecting metadata for OSV advisories, which are not mutually exclusive:

Via a new API

One possibility is to create a new API that provides access to additional metadata for advisories. The API could be designed to work with any ID alias, such as GHSA, DSA, and return a JSON object containing the metadata. For example:

{
  "aliases": ["CVE-1234", "GHSA-1234", "DSA-1234"],
  "cvss": [
    {"source": "nvd", "value": "..."}
  ],
  "cwe": [
    {"source": "nvd", "value": "..."}
  ],
  "epss": [
    {"source": "first.org", "value", "..."}
  ],
  "kev": [
      {"source": "cisa.gov", "value": true/false}
  ]
}

Via data dumps

Another possibility is to provide the same data via data dumps, which can be accessed through a Google Cloud Storage bucket. For example:

gs://osv-vulnerabilities/extra_metadata/CVE-1234.json

This would contain the same JSON object as the API.

Benefits of Enhanced Metadata

The benefits of aggregating and collecting metadata for OSV advisories are numerous. Some of the key advantages include:

Improved security posture: By having access to additional metadata, organizations can make informed decisions about their security posture and take proactive steps to mitigate vulnerabilities.
Enhanced risk-based decisions: Metadata can be used to inform risk-based decisions, such as prioritizing vulnerabilities for remediation.
Improved security practices: By having access to additional metadata, organizations can improve their security practices and reduce the risk of vulnerabilities.

Conclusion

In conclusion, aggregating and collecting metadata for OSV advisories can be a game-changer for organizations looking to enhance their security posture. By exploring possibilities such as a new API and data dumps, users can access valuable information that can inform risk-based decisions and improve overall security practices. As the security landscape continues to evolve, it is essential to have access to accurate and comprehensive vulnerability data. By connecting the dots between OSV advisories and other metadata, we can unlock the power of metadata and take proactive steps to mitigate vulnerabilities.
Easier way to connect between OSV advisories and other metadata (e.g. CWEs, CVSS, EPSS, CISA KEV)

Q&A: Unlocking the Power of Metadata for OSV Advisories

In our previous article, we explored the importance of aggregating and collecting metadata for OSV advisories. We discussed the challenges of accessing additional metadata and the benefits of having access to this valuable information. In this article, we will answer some frequently asked questions about the new API and data dumps, and provide more insights into the world of metadata.

Q: What is the new API, and how does it work?

A: The new API is a web service that provides access to additional metadata for OSV advisories. It can be used to retrieve metadata for a specific vulnerability, such as CVSS, CWE, EPSS, and CISA KEV. The API can be accessed using any ID alias, such as GHSA, DSA, and returns a JSON object containing the metadata.

Q: What is the format of the JSON object returned by the API?

A: The JSON object returned by the API contains the following metadata:

aliases: a list of aliases for the vulnerability, such as CVE-1234, GHSA-1234, and DSA-1234.
cvss: a list of CVSS scores, including the source and value.
cwe: a list of CWE IDs, including the source and value.
epss: a list of EPSS scores, including the source and value.
kev: a list of CISA KEV scores, including the source and value.

Q: How do I access the data dumps?

A: The data dumps can be accessed through a Google Cloud Storage bucket. You can use the following URL to access the data dump for a specific vulnerability:

gs://osv-vulnerabilities/extra_metadata/CVE-1234.json

This will return the same JSON object as the API.

Q: What are the benefits of using the new API and data dumps?

A: The benefits of using the new API and data dumps include:

Improved security posture: By having access to additional metadata, organizations can make informed decisions about their security posture and take proactive steps to mitigate vulnerabilities.
Enhanced risk-based decisions: Metadata can be used to inform risk-based decisions, such as prioritizing vulnerabilities for remediation.
Improved security practices: By having access to additional metadata, organizations can improve their security practices and reduce the risk of vulnerabilities.

Q: How do I get started with the new API and data dumps?

A: To get started with the new API and data dumps, you will need to:

Register for an API key: You will need to register for an API key to access the new API.
Access the data dumps: You can access the data dumps through a Google Cloud Storage bucket.
Use the API: You can use the API to retrieve metadata for a specific vulnerability.

Q: What are the limitations of the new API and data dumps?

A: The limitations of the new API and data dumps include:

Data availability: The data available through the API and data dumps may not be comprehensive or up-to-date.
Data accuracy: The accuracy of the data available through the API and data dumps may vary.
API usage: The API may have usage limits or restrictions.

Q: How do I provide feedback or report issues with the new API and data dumps?

A: You can provide feedback or report issues with the new API and data dumps by:

Contacting support: You can contact support through the OSV website or email.
Using the API documentation: You can use the API documentation to report issues or provide feedback.
Submitting a bug report: You can submit a bug report through the OSV website or email.

Conclusion

In conclusion, the new API and data dumps provide a powerful tool for organizations to access additional metadata for OSV advisories. By using the API and data dumps, organizations can improve their security posture, enhance risk-based decisions, and improve security practices. We hope this Q&A article has provided you with the information you need to get started with the new API and data dumps. If you have any further questions or need additional assistance, please don't hesitate to contact us.