https://spdx.org/rdf/3.0.1/terms/Security/VexNotAffectedVulnAssessmentRelationship
Links a vulnerability and one or more elements designating the latter as products
not affected by the vulnerability.
By the associated SHACL property shapes, instances of security:VexNotAffectedVulnAssessmentRelationship can have the following properties:
| PROPERTY | PROPERTY TYPE | DESCRIPTION | MIN | MAX | VALUE TYPE | OTHER CONSTRAINTS | GLOBAL RANGE |
|---|---|---|---|---|---|---|---|
| security:VexNotAffectedVulnAssessmentRelationship | |||||||
| security:impactStatement | owl:DatatypeProperty | Explains why a VEX product is not affected by a vulnerability. It is an alternative in VexNotAffectedVulnAssessmentRelationship to the machine-readable justification label. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| security:impactStatementTime | owl:DatatypeProperty | Timestamp of impact statement. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| security:justificationType | owl:ObjectProperty | Impact justification label to be used when linking a vulnerability to an element representing a VEX product with a VexNotAffectedVulnAssessmentRelationship relationship. | 0 | 1 | security:VexJustificationType sh:IRI |
sh:in
security:VexJustificationType/componentNotPresent, security:VexJustificationType/vulnerableCodeNotPresent, security:VexJustificationType/vulnerableCodeCannotBeControlledByAdversary, security:VexJustificationType/vulnerableCodeNotInExecutePath, security:VexJustificationType/inlineMitigationsAlreadyExist
|
security:VexJustificationType |
| security:VexVulnAssessmentRelationship | |||||||
rdf:type |
-- | sh:message https://spdx.org/rdf/3.0.1/terms/Security/VexVulnAssessmentRelationship is an abstract class and should not be instantiated directly. Instantiate a subclass instead. |
0 | * |
sh:not
sh:hasValue security:VexVulnAssessmentRelationship
|
-- | |
| security:statusNotes | owl:DatatypeProperty | Conveys information about how VEX status was determined. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| security:vexVersion | owl:DatatypeProperty | Specifies the version of a VEX statement. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| security:VulnAssessmentRelationship | |||||||
| core:suppliedBy | owl:ObjectProperty | Identifies who or what supplied the artifact or VulnAssessmentRelationship referenced by the Element. | 0 | 1 | core:Agent sh:IRI |
core:Agent | |
rdf:type |
-- | sh:message https://spdx.org/rdf/3.0.1/terms/Security/VulnAssessmentRelationship is an abstract class and should not be instantiated directly. Instantiate a subclass instead. |
0 | * |
sh:not
sh:hasValue security:VulnAssessmentRelationship
|
-- | |
| security:assessedElement | owl:ObjectProperty | Specifies an Element contained in a piece of software where a vulnerability was found. | 0 | 1 | software:SoftwareArtifact sh:IRI |
software:SoftwareArtifact | |
| security:modifiedTime | owl:DatatypeProperty | Specifies a time when a vulnerability assessment was modified | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| security:publishedTime | owl:DatatypeProperty | Specifies the time when a vulnerability was published. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| security:withdrawnTime | owl:DatatypeProperty | Specified the time and date when a vulnerability was withdrawn. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| core:Relationship | |||||||
| core:completeness | owl:ObjectProperty | Provides information about the completeness of relationships. | 0 | 1 | core:RelationshipCompleteness sh:IRI |
sh:in
core:RelationshipCompleteness/incomplete, core:RelationshipCompleteness/complete, core:RelationshipCompleteness/noAssertion
|
core:RelationshipCompleteness |
| core:endTime | owl:DatatypeProperty | Specifies the time from which an element is no longer applicable / valid. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| core:from | owl:ObjectProperty | References the Element on the left-hand side of a relationship. | 1 | 1 | core:Element sh:IRI |
core:Element | |
| core:relationshipType | owl:ObjectProperty | Information about the relationship between two Elements. | 1 | 1 | core:RelationshipType sh:IRI |
sh:in
core:RelationshipType/affects, core:RelationshipType/amendedBy, core:RelationshipType/ancestorOf, core:RelationshipType/availableFrom, core:RelationshipType/configures, core:RelationshipType/contains, core:RelationshipType/coordinatedBy, core:RelationshipType/copiedTo, core:RelationshipType/delegatedTo, core:RelationshipType/dependsOn, core:RelationshipType/descendantOf, core:RelationshipType/describes, core:RelationshipType/doesNotAffect, core:RelationshipType/expandsTo, core:RelationshipType/exploitCreatedBy, core:RelationshipType/fixedBy, core:RelationshipType/fixedIn, core:RelationshipType/foundBy, core:RelationshipType/generates, core:RelationshipType/hasAddedFile, core:RelationshipType/hasAssessmentFor, core:RelationshipType/hasAssociatedVulnerability, core:RelationshipType/hasConcludedLicense, core:RelationshipType/hasDataFile, core:RelationshipType/hasDeclaredLicense, core:RelationshipType/hasDeletedFile, core:RelationshipType/hasDependencyManifest, core:RelationshipType/hasDistributionArtifact, core:RelationshipType/hasDocumentation, core:RelationshipType/hasDynamicLink, core:RelationshipType/hasEvidence, core:RelationshipType/hasExample, core:RelationshipType/hasHost, core:RelationshipType/hasInput, core:RelationshipType/hasMetadata, core:RelationshipType/hasOptionalComponent, core:RelationshipType/hasOptionalDependency, core:RelationshipType/hasOutput, core:RelationshipType/hasPrerequisite, core:RelationshipType/hasProvidedDependency, core:RelationshipType/hasRequirement, core:RelationshipType/hasSpecification, core:RelationshipType/hasStaticLink, core:RelationshipType/hasTest, core:RelationshipType/hasTestCase, core:RelationshipType/hasVariant, core:RelationshipType/invokedBy, core:RelationshipType/modifiedBy, core:RelationshipType/other, core:RelationshipType/packagedBy, core:RelationshipType/patchedBy, core:RelationshipType/publishedBy, core:RelationshipType/reportedBy, core:RelationshipType/republishedBy, core:RelationshipType/serializedInArtifact, core:RelationshipType/testedOn, core:RelationshipType/trainedOn, core:RelationshipType/underInvestigationFor, core:RelationshipType/usesTool
|
core:RelationshipType |
| core:startTime | owl:DatatypeProperty | Specifies the time from which an element is applicable / valid. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| core:to | owl:ObjectProperty | References an Element on the right-hand side of a relationship. | 1 | * | core:Element sh:IRI |
core:Element | |
| core:Element | |||||||
| core:comment | owl:DatatypeProperty | Provide consumers with comments by the creator of the Element about the Element. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:creationInfo | owl:ObjectProperty | Provides information about the creation of the Element. | 1 | 1 | core:CreationInfo sh:BlankNodeOrIRI |
core:CreationInfo | |
| core:description | owl:DatatypeProperty | Provides a detailed description of the Element. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:extension | owl:ObjectProperty | Specifies an Extension characterization of some aspect of an Element. sh:message Class is known to not derive from Extension and cannot be used |
0 | * | sh:BlankNodeOrIRI |
sh:not
sh:or (security:SsvcVulnAssessmentRelationship, security:CvssV2VulnAssessmentRelationship, security:ExploitCatalogVulnAssessmentRelationship, security:CvssV4VulnAssessmentRelationship, security:VexAffectedVulnAssessmentRelationship, security:VexNotAffectedVulnAssessmentRelationship, security:CvssV3VulnAssessmentRelationship, security:Vulnerability, security:VexUnderInvestigationVulnAssessmentRelationship, security:EpssVulnAssessmentRelationship, security:VexFixedVulnAssessmentRelationship, core:NamespaceMap, core:LifecycleScopedRelationship, core:Hash, core:Agent, core:CreationInfo, core:ExternalRef, core:Bom, core:IndividualElement, core:Relationship, core:PositiveIntegerRange, core:DictionaryEntry, core:ExternalMap, core:Annotation, core:SpdxDocument, core:Person, core:Organization, core:Bundle, core:Tool, core:ExternalIdentifier, core:SoftwareAgent, core:PackageVerificationCode, ai:AIPackage, ai:EnergyConsumptionDescription, ai:EnergyConsumption, build:Build, dataset:DatasetPackage, expandedlicensing:CustomLicense, expandedlicensing:OrLaterOperator, expandedlicensing:ListedLicense, expandedlicensing:DisjunctiveLicenseSet, expandedlicensing:ListedLicenseException, expandedlicensing:WithAdditionOperator, expandedlicensing:IndividualLicensingInfo, expandedlicensing:CustomLicenseAddition, expandedlicensing:ConjunctiveLicenseSet, simplelicensing:LicenseExpression, simplelicensing:SimpleLicensingText, extension:CdxPropertyEntry, software:Package, software:File, software:Sbom, software:Snippet, software:ContentIdentifier)
|
extension:Extension |
| core:externalIdentifier | owl:ObjectProperty | Provides a reference to a resource outside the scope of SPDX-3.0 content that uniquely identifies an Element. | 0 | * | core:ExternalIdentifier sh:BlankNodeOrIRI |
core:ExternalIdentifier | |
| core:externalRef | owl:ObjectProperty | Points to a resource outside the scope of the SPDX-3.0 content that provides additional characteristics of an Element. | 0 | * | core:ExternalRef sh:BlankNodeOrIRI |
core:ExternalRef | |
| core:name | owl:DatatypeProperty | Identifies the name of an Element as designated by the creator. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:summary | owl:DatatypeProperty | A short description of an Element. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:verifiedUsing | owl:ObjectProperty | Provides an IntegrityMethod with which the integrity of an Element can be asserted. | 0 | * | core:IntegrityMethod sh:BlankNodeOrIRI |
core:IntegrityMethod | |
rdf:type |
-- | sh:message https://spdx.org/rdf/3.0.1/terms/Core/Element is an abstract class and should not be instantiated directly. Instantiate a subclass instead. |
0 | * |
sh:not
sh:hasValue core:Element
|
-- | |
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix security: <https://spdx.org/rdf/3.0.1/terms/Security/> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
security:VexNotAffectedVulnAssessmentRelationship a owl:Class,
sh:NodeShape ;
rdfs:comment """Links a vulnerability and one or more elements designating the latter as products
not affected by the vulnerability."""@en ;
rdfs:subClassOf security:VexVulnAssessmentRelationship ;
sh:nodeKind sh:IRI ;
sh:property [ sh:datatype xsd:dateTimeStamp ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path security:impactStatementTime ;
sh:pattern "^\\d\\d\\d\\d-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\dZ$" ],
[ sh:class security:VexJustificationType ;
sh:in ( <https://spdx.org/rdf/3.0.1/terms/Security/VexJustificationType/componentNotPresent> <https://spdx.org/rdf/3.0.1/terms/Security/VexJustificationType/vulnerableCodeNotPresent> <https://spdx.org/rdf/3.0.1/terms/Security/VexJustificationType/vulnerableCodeCannotBeControlledByAdversary> <https://spdx.org/rdf/3.0.1/terms/Security/VexJustificationType/vulnerableCodeNotInExecutePath> <https://spdx.org/rdf/3.0.1/terms/Security/VexJustificationType/inlineMitigationsAlreadyExist> ) ;
sh:maxCount 1 ;
sh:nodeKind sh:IRI ;
sh:path security:justificationType ],
[ sh:datatype xsd:string ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path security:impactStatement ] .