Pour obtenir les autorisations nécessaires pour importer des évaluations VEX et vérifier l'état VEX des failles, demandez à votre administrateur de vous accorder les rôles IAM suivants sur le projet :
Artifact Analysis stocke les notes d'évaluation des failles sous forme d'une note par CVE. Les notes sont stockées dans l'API Container Analysis, dans le même projet que l'image spécifiée.
Lorsque vous importez des instructions VEX, Artifact Analysis transfère également les informations sur l'état VEX dans les occurrences de failles associées afin que vous puissiez filtrer les failles par état VEX. Si une instruction VEX est appliquée à une image, Artifact Analysis reporte l'état VEX à toutes les versions de cette image, y compris les versions récemment transférées.
Si une même version comporte deux déclarations VEX, l'une écrite pour l'URL de la ressource et l'autre pour l'URL de l'image associée, la déclaration VEX écrite pour l'URL de la ressource prévaudra et sera reportée sur l'occurrence de la faille.
Étapes suivantes
Hiérarchisez les problèmes de failles à l'aide de VEX. Découvrez comment afficher les instructions VEX et filtrer les failles en fonction de leur état VEX.
Recherchez les failles dans les packages de système d'exploitation et les packages de langage avec Artifact Analysis.
Sauf indication contraire, le contenu de cette page est régi par une licence Creative Commons Attribution 4.0, et les échantillons de code sont régis par une licence Apache 2.0. Pour en savoir plus, consultez les Règles du site Google Developers. Java est une marque déposée d'Oracle et/ou de ses sociétés affiliées.
Dernière mise à jour le 2025/09/03 (UTC).
[[["Facile à comprendre","easyToUnderstand","thumb-up"],["J'ai pu résoudre mon problème","solvedMyProblem","thumb-up"],["Autre","otherUp","thumb-up"]],[["Difficile à comprendre","hardToUnderstand","thumb-down"],["Informations ou exemple de code incorrects","incorrectInformationOrSampleCode","thumb-down"],["Il n'y a pas l'information/les exemples dont j'ai besoin","missingTheInformationSamplesINeed","thumb-down"],["Problème de traduction","translationIssue","thumb-down"],["Autre","otherDown","thumb-down"]],["Dernière mise à jour le 2025/09/03 (UTC)."],[[["\u003cp\u003eThis document details the process of uploading Vulnerability Exploitability eXchange (VEX) statements, which must adhere to the Common Security Advisory Format (CSAF) 2.0 standard in JSON, to Artifact Analysis.\u003c/p\u003e\n"],["\u003cp\u003eUploading VEX statements requires specific IAM roles, such as Container Analysis Notes Editor, to create and update notes within the project.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eartifacts vulnerabilities load-vex\u003c/code\u003e command is used to upload VEX data, where users specify the path to the CSAF-formatted JSON file and the URI of the resource or image.\u003c/p\u003e\n"],["\u003cp\u003eArtifact Analysis converts VEX statements into Grafeas \u003ccode\u003eVulnerabilityAssessment\u003c/code\u003e notes, storing them as one note per CVE within the Container Analysis API, and it carries VEX status information to associated vulnerability occurrences.\u003c/p\u003e\n"],["\u003cp\u003ePre-GA features are available "as is" and might have limited support, and using this feature is subject to the "Pre-GA Offerings Terms" found in the General Service Terms section of the service specific terms.\u003c/p\u003e\n"]]],[],null,["# Upload VEX statements\n\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis document describes how to upload existing\n[Vulnerability Exploitability eXchange (VEX)](https://www.cisa.gov/sites/default/files/2023-04/minimum-requirements-for-vex-508c.pdf)\nstatements to Artifact Analysis. You can also upload statements provided by other\npublishers.\n\nVEX statements must be formatted according to the\n[Common Security Advisory Format (CSAF)](https://oasis-open.github.io/csaf-documentation/) 2.0 standard in JSON.\n\nRequired roles\n--------------\n\n\nTo get the permissions that\nyou need to upload VEX assessments and check the VEX status of vulnerabilities,\n\nask your administrator to grant you the\nfollowing IAM roles on the project:\n\n- To create and update notes: [Container Analysis Notes Editor](/iam/docs/roles-permissions/containeranalysis#containeranalysis.notes.editor) (`roles/containeranalysis.notes.editor`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nUpload VEX statements\n---------------------\n\nRun the\n[`artifacts vulnerabilities load-vex`](/sdk/gcloud/reference/artifacts/vulnerabilities/load-vex)\ncommand to upload VEX data and store it in Artifact Analysis: \n\n gcloud artifacts vulnerabilities load-vex /\n --source \u003cvar translate=\"no\"\u003eCSAF_SOURCE\u003c/var\u003e /\n --uri \u003cvar translate=\"no\"\u003eRESOURCE_URI\u003c/var\u003e /\n\nWhere\n\n- \u003cvar translate=\"no\"\u003eCSAF_SOURCE\u003c/var\u003e is the path to your VEX statement file stored locally. The file must be a JSON file following the [CSAF schema](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/json_schema/csaf_json_schema.json).\n- \u003cvar translate=\"no\"\u003eRESOURCE_URI\u003c/var\u003e can be one of:\n - the complete URL of the image, similar to `https://LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE_ID@sha256:HASH`.\n - the image URL, similar to `https://LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE_ID`.\n\nArtifact Analysis converts your VEX statements to\n[Grafeas `VulnerabilityAssessment`](https://github.com/grafeas/grafeas/blob/master/proto/v1/vex.proto#L28) notes.\n\nArtifact Analysis stores vulnerability assessment notes as one note per\nCVE. Notes are stored in the Container Analysis API, within the same project as the\nspecified image.\n\nWhen you upload VEX statements, Artifact Analysis also carries VEX status\ninformation into associated [vulnerability occurrences](/artifact-analysis/docs/metadata-storage#occurrence) so that\nyou can filter vulnerabilities by VEX status. If a VEX statement is applied to\nan image, Artifact Analysis will carry over the VEX status to all versions\nof that image, including newly pushed versions.\n\nIf a single version has two VEX statements, one written for the resource URL\nand one written for the associated image URL, the VEX statement written for the\nresource URL will take precedence and will be carried over to the vulnerability\noccurrence.\n\nWhat's next\n-----------\n\n- Prioritize vulnerability issues using VEX. Learn how to [view VEX statements](/artifact-analysis/docs/view-vex) and filter vulnerabilities by their VEX status.\n- Learn how to [generate a software bill of materials](/artifact-analysis/docs/sbom-overview) (SBOM) to support compliance requirements.\n- [Scan for vulnerabilities](/artifact-analysis/docs/scanning-types) in OS packages and language packages with Artifact Analysis."]]
