https://spdx.org/rdf/3.0.1/terms/Security/Vulnerability
Specifies a vulnerability and its associated information.
By the associated SHACL property shapes, instances of security:Vulnerability can have the following properties:
| PROPERTY | PROPERTY TYPE | DESCRIPTION | MIN | MAX | VALUE TYPE | OTHER CONSTRAINTS | GLOBAL RANGE |
|---|---|---|---|---|---|---|---|
| security:Vulnerability | |||||||
| security:modifiedTime | owl:DatatypeProperty | Specifies a time when a vulnerability assessment was modified | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| security:publishedTime | owl:DatatypeProperty | Specifies the time when a vulnerability was published. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| security:withdrawnTime | owl:DatatypeProperty | Specified the time and date when a vulnerability was withdrawn. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| core:Artifact | |||||||
| core:builtTime | owl:DatatypeProperty | Specifies the time an artifact was built. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| core:originatedBy | owl:ObjectProperty | Identifies from where or whom the Element originally came. | 0 | * | core:Agent sh:IRI |
core:Agent | |
| core:releaseTime | owl:DatatypeProperty | Specifies the time an artifact was released. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
| core:standardName | owl:DatatypeProperty | The name of a relevant standard that may apply to an artifact. | 0 | * | xsd:string sh:Literal |
xsd:string | |
| core:suppliedBy | owl:ObjectProperty | Identifies who or what supplied the artifact or VulnAssessmentRelationship referenced by the Element. | 0 | 1 | core:Agent sh:IRI |
core:Agent | |
| core:supportLevel | owl:ObjectProperty | Specifies the level of support associated with an artifact. | 0 | * | core:SupportType sh:IRI |
sh:in
core:SupportType/development, core:SupportType/support, core:SupportType/deployed, core:SupportType/limitedSupport, core:SupportType/endOfSupport, core:SupportType/noSupport, core:SupportType/noAssertion
|
core:SupportType |
| core:validUntilTime | owl:DatatypeProperty | Specifies until when the artifact can be used before its usage needs to be reassessed. | 0 | 1 | xsd:dateTimeStamp sh:Literal |
sh:pattern
^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
|
xsd:dateTimeStamp |
rdf:type |
-- | sh:message https://spdx.org/rdf/3.0.1/terms/Core/Artifact is an abstract class and should not be instantiated directly. Instantiate a subclass instead. |
0 | * |
sh:not
sh:hasValue core:Artifact
|
-- | |
| core:Element | |||||||
| core:comment | owl:DatatypeProperty | Provide consumers with comments by the creator of the Element about the Element. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:creationInfo | owl:ObjectProperty | Provides information about the creation of the Element. | 1 | 1 | core:CreationInfo sh:BlankNodeOrIRI |
core:CreationInfo | |
| core:description | owl:DatatypeProperty | Provides a detailed description of the Element. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:extension | owl:ObjectProperty | Specifies an Extension characterization of some aspect of an Element. sh:message Class is known to not derive from Extension and cannot be used |
0 | * | sh:BlankNodeOrIRI |
sh:not
sh:or (security:SsvcVulnAssessmentRelationship, security:CvssV2VulnAssessmentRelationship, security:ExploitCatalogVulnAssessmentRelationship, security:CvssV4VulnAssessmentRelationship, security:VexAffectedVulnAssessmentRelationship, security:VexNotAffectedVulnAssessmentRelationship, security:CvssV3VulnAssessmentRelationship, security:Vulnerability, security:VexUnderInvestigationVulnAssessmentRelationship, security:EpssVulnAssessmentRelationship, security:VexFixedVulnAssessmentRelationship, core:NamespaceMap, core:LifecycleScopedRelationship, core:Hash, core:Agent, core:CreationInfo, core:ExternalRef, core:Bom, core:IndividualElement, core:Relationship, core:PositiveIntegerRange, core:DictionaryEntry, core:ExternalMap, core:Annotation, core:SpdxDocument, core:Person, core:Organization, core:Bundle, core:Tool, core:ExternalIdentifier, core:SoftwareAgent, core:PackageVerificationCode, ai:AIPackage, ai:EnergyConsumptionDescription, ai:EnergyConsumption, build:Build, dataset:DatasetPackage, expandedlicensing:CustomLicense, expandedlicensing:OrLaterOperator, expandedlicensing:ListedLicense, expandedlicensing:DisjunctiveLicenseSet, expandedlicensing:ListedLicenseException, expandedlicensing:WithAdditionOperator, expandedlicensing:IndividualLicensingInfo, expandedlicensing:CustomLicenseAddition, expandedlicensing:ConjunctiveLicenseSet, simplelicensing:LicenseExpression, simplelicensing:SimpleLicensingText, extension:CdxPropertyEntry, software:Package, software:File, software:Sbom, software:Snippet, software:ContentIdentifier)
|
extension:Extension |
| core:externalIdentifier | owl:ObjectProperty | Provides a reference to a resource outside the scope of SPDX-3.0 content that uniquely identifies an Element. | 0 | * | core:ExternalIdentifier sh:BlankNodeOrIRI |
core:ExternalIdentifier | |
| core:externalRef | owl:ObjectProperty | Points to a resource outside the scope of the SPDX-3.0 content that provides additional characteristics of an Element. | 0 | * | core:ExternalRef sh:BlankNodeOrIRI |
core:ExternalRef | |
| core:name | owl:DatatypeProperty | Identifies the name of an Element as designated by the creator. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:summary | owl:DatatypeProperty | A short description of an Element. | 0 | 1 | xsd:string sh:Literal |
xsd:string | |
| core:verifiedUsing | owl:ObjectProperty | Provides an IntegrityMethod with which the integrity of an Element can be asserted. | 0 | * | core:IntegrityMethod sh:BlankNodeOrIRI |
core:IntegrityMethod | |
rdf:type |
-- | sh:message https://spdx.org/rdf/3.0.1/terms/Core/Element is an abstract class and should not be instantiated directly. Instantiate a subclass instead. |
0 | * |
sh:not
sh:hasValue core:Element
|
-- | |
@prefix core: <https://spdx.org/rdf/3.0.1/terms/Core/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix security: <https://spdx.org/rdf/3.0.1/terms/Security/> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
security:Vulnerability a owl:Class,
sh:NodeShape ;
rdfs:comment "Specifies a vulnerability and its associated information."@en ;
rdfs:subClassOf core:Artifact ;
sh:nodeKind sh:IRI ;
sh:property [ sh:datatype xsd:dateTimeStamp ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path security:withdrawnTime ;
sh:pattern "^\\d\\d\\d\\d-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\dZ$" ],
[ sh:datatype xsd:dateTimeStamp ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path security:modifiedTime ;
sh:pattern "^\\d\\d\\d\\d-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\dZ$" ],
[ sh:datatype xsd:dateTimeStamp ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path security:publishedTime ;
sh:pattern "^\\d\\d\\d\\d-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\dZ$" ] .