Creating Exceptions Using VEX Documents in Docker Scout

--- title: Create an exception using the VEX description: Create an exception for a vulnerability in an image using VEX documents. keywords: Docker, vulnerability, exception, create, VEX aliases: - /scout/guides/vex/ --- Vulnerability Exploitability eXchange (VEX) is a standard format for documenting vulnerabilities in the context of a software package or product. Docker Scout supports VEX documents to create [exceptions](/manuals/scout/explore/exceptions.md) for vulnerabilities in images. > [!NOTE] > You can also create exceptions using the Docker Scout Dashboard or Docker > Desktop. The GUI provides a user-friendly interface for creating exceptions, > and it's easy to manage exceptions for multiple images. It also lets you > create exceptions for multiple images, or your entire organization, all at > once. For more information, see [Create an exception using the GUI](/manuals/scout/how-tos/create-exceptions-gui.md). ## Prerequisites To create exceptions using OpenVEX documents, you need: - The latest version of Docker Desktop or the Docker Scout CLI plugin - The [`vexctl`](https://github.com/openvex/vexctl) command line tool. - The [containerd image store](/manuals/desktop/features/containerd.md) must be enabled - Write permissions to the registry repository where the image is stored ## Introduction to VEX The VEX standard is defined by a working group by the United States Cybersecurity and Infrastructure Security Agency (CISA). At the core of VEX are exploitability assessments. These assessments describe the status of a given CVE for a product. The possible vulnerability statuses in VEX are: - Not affected: No remediation is required regarding this vulnerability. - Affected: Actions are recommended to remediate or address this vulnerability. - Fixed: These product versions contain a fix for the vulnerability. - Under investigation: It is not yet known whether these product versions are affected by the vulnerability. An update will be provided in a later release. There are multiple implementations and formats of VEX. Docker Scout supports the [OpenVex](https://github.com/openvex/spec) implementation. Regardless of the specific implementation, the core idea is the same: to provide a framework for describing the impact of vulnerabilities. Key components of VEX regardless of implementation includes: VEX document : A type of security advisory for storing VEX statements. The format of the document depends on the specific implementation. VEX statement : Describes the status of a vulnerability in a product, whether it's exploitable, and whether there are ways to remediate the issue. Justification and impact : Depending on the vulnerability status, statements include a justification or impact statement describing why a product is or isn't affected. Action statements : Describe how to remediate or mitigate the vulnerability. ## `vexctl` example The following example command creates a VEX document stating that: - The software product described by this VEX document is the Docker image `example/app:v1` - The image contains the npm package `express@4.17.1` - The npm package is affected by a known vulnerability: `CVE-2022-24999` - The image is unaffected by the CVE, because the vulnerable code is never executed in containers that run this image ```console $ vexctl create \ --author="author@example.com" \ --product="pkg:docker/example/app@v1" \ --subcomponents="pkg:npm/express@4.17.1" \ --vuln="CVE-2022-24999" \ --status="not_affected" \ --justification="vulnerable_code_not_in_execute_path" \ --file="CVE-2022-24999.vex.json" ``` Here's a description of the options in this example: `--author` : The email of the author of the VEX document. `--product` : Package URL (PURL) of the Docker image. A PURL is an identifier for the image in a standardized format, defined in the PURL [specification](https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#docker). Docker image PURL strings begin with a `pkg:docker` type prefix, followed by

This document describes how to use Vulnerability Exploitability eXchange (VEX) documents with Docker Scout to create exceptions for vulnerabilities found in container images. It outlines the prerequisites, introduces the VEX standard and its components (VEX document, VEX statement, justification/impact, and action statements), and provides a `vexctl` example for creating a VEX document that declares an image as not affected by a specific CVE due to the vulnerable code not being executed.