Added workarounds to vulnerability spec

Signed-off-by: Steve Springett <[email protected]>

Author: stevespringett

schema/bom-1.5.proto

@@ -606,6 +606,8 @@ message Vulnerability {
   optional google.protobuf.Timestamp rejected = 19;
   // Evidence used to reproduce the vulnerability.
   optional ProofOfConcept proofOfConcept = 20;
+  // A bypass, usually temporary, of the vulnerability that reduces its likelihood and/or impact. Workarounds often involve changes to configuration or deployments.
+  optional string workaround = 21;
 }
 
 message ProofOfConcept {

schema/bom-1.5.schema.json

@@ -1672,9 +1672,14 @@
         },
         "recommendation": {
           "type": "string",
-          "title": "Details",
+          "title": "Recommendation",
           "description": "Recommendations of how the vulnerability can be remediated or mitigated."
         },
+        "workaround": {
+          "type": "string",
+          "title": "Workarounds",
+          "description": "A bypass, usually temporary, of the vulnerability that reduces its likelihood and/or impact. Workarounds often involve changes to configuration or deployments."
+        },
         "proofOfConcept": {
           "type": "object",
           "title": "Proof of Concept",

schema/bom-1.5.xsd

@@ -2102,6 +2102,11 @@ limitations under the License.
                     <xs:documentation>Recommendations of how the vulnerability can be remediated or mitigated.</xs:documentation>
                 </xs:annotation>
             </xs:element>
+            <xs:element name="workaround" type="xs:string" minOccurs="0" maxOccurs="1">
+                <xs:annotation>
+                    <xs:documentation>A bypass, usually temporary, of the vulnerability that reduces its likelihood and/or impact. Workarounds often involve changes to configuration or deployments.</xs:documentation>
+                </xs:annotation>
+            </xs:element>
             <xs:element name="proofOfConcept" minOccurs="0" maxOccurs="1">
                 <xs:complexType>
                     <xs:annotation>

tools/src/test/resources/1.5/valid-vulnerability-1.5.json

@@ -50,6 +50,7 @@
       "description": "FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.",
       "detail": "",
       "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.5, 2.8.11.1, 2.9.5 or higher.",
+      "workaround": "Describe the workarounds here",
       "proofOfConcept": {
         "reproductionSteps": "Precise steps to reproduce go here",
         "environment": "Describe the environment",

tools/src/test/resources/1.5/valid-vulnerability-1.5.textproto

@@ -1,6 +1,3 @@
-# proto-file: bom-1.5.proto
-# proto-message: Bom
-
 spec_version: "1.5"
 version: 1
 serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
@@ -142,4 +139,5 @@ vulnerabilities {
     name: "Bar"
     value: "Foo"
   }
+  workaround: "Describe the workarounds here"
 }

tools/src/test/resources/1.5/valid-vulnerability-1.5.xml

@@ -51,6 +51,7 @@
             <description>FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.</description>
             <detail></detail>
             <recommendation>Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.5, 2.8.11.1, 2.9.5 or higher.</recommendation>
+            <workaround>Describe the workarounds here</workaround>
             <proofOfConcept>
                 <reproductionSteps>Precise steps to reproduce go here</reproductionSteps>
                 <environment>Describe the environment</environment>