Giuseppe Di Terlizzi

If you work anywhere near vulnerability management, you've run into the CVSS problem: a single severity number that tells you almost nothing about what to actually do. CVSS was never designed to be a triage tool, and treating it like one is how organizations end up "patching everything" or, worse, patching nothing because everything looks equally urgent.

SSVC (Stakeholder-Specific Vulnerability Categorization), developed by Carnegie Mellon's SEI (CERT/CC) and later adapted by CISA into its own decision tree, takes a different approach: instead of a score, it's a decision tree. You feed in a handful of factors specific to your role - exploitation status and technical impact for some methodologies, safety and market-share considerations for others - and it hands you back an actual decision: track it, act on it, attend to it now. Which factors matter, and what decision comes out, depends on who you are in the vulnerability management chain - a vendor, a deployer, a coordinator, a finder - because a coordinator publishing an advisory and a deployer patching a fleet of servers are answering completely different questions with completely different inputs.

I've released a new version of SBOM::CycloneDX with support for the OWASP CycloneDX 1.7 specification (ECMA-424).

This release includes the new elements introduced in 1.7, with a focus on:

• Enhancements to Cryptography Bill of Materials (CBOM)
• Citations: references and sources for evidence/metadata
• Intellectual Property Transparency: references to associated patents (number, jurisdiction, link, assignee) for compliance / due diligence needs

New experimental "SBOM::CycloneDX::Lite" interface: A lightweight module designed to generate BOMs with a simpler API, using the most common CycloneDX properties.

Examples included in the distribution (use them as a starting point to build your own applications/tools that generate BOM files):

• "x509-to-cbom" : generates a CBOM from an X.509 certificate
• "rpm-to-sbom" : generates a SBOM from installed RPM packages (on RHEL-based)

The goal of this module is to help the Perl community generate BOM files more easily, improving security and compliance across the ecosystem and making the software supply chain more transparent.

SBOM::CycloneDX is available on CPAN / MetaCPAN: https://metacpan.org/pod/SBOM::CycloneDX

Related projects: - App::CPAN::SBOM - https://metacpan.org/dist/App-CPAN-SBOM - Modules::CoreList::SBOM - https://github.com/giterlizzi/perl-Module-CoreList-SBOM