Software Identity in the Vulnerability Management Ecosystem

### Overview This panel discussion, titled 'Software Identity in the Vulnerability Management Ecosystem', explores the challenges and ongoing efforts surrounding software identification standards within vulnerability management, specifically regarding the CVE and NVD ecosystems. Moderated by Alex Hmers (MITRE CVE and CWE project lead), the panel features Megazone (F5, co-chair of the CVE Quality Working Group), Chris Turner (NVD/NIST senior adviser), Steve Springett (ServiceNow, CycloneDX and ECMA TC54 chair), and Andrew (MITRE, Omnibore project). The session levels on the premise that no single identifier currently addresses every software identification need, necessitating a multi-identifier ecosystem spanning centralized, federated, and decentralized schemes.

### Key Topics - **The Multi-Identifier Ecosystem**: The panel discusses the necessity of accommodating different identifier formats rather than mandating a single solution, comparing centralized, defined systems against decentralized and inherent models. - **CPE in the CVE Record Format**: Recent updates added structured support for Common Platform Enumeration (CPE) applicability language in the CVE record schema, addressing prior shortcomings where CPE was simply an ambiguous array of values. - **Package URL (purl)**: Originating as an open specification started around 2016–2017, purl provides decentralized identification aligned with package managers (e.g., npm, PyPI, Maven) and is pursuing standardization under ECMA TC54. - **Omnibore**: A newer, completely distributed scheme producing inherent identifiers (artifact IDs) derived directly from binary or source artifacts rather than centralized names or package registries. - **CVE Record Integration and Proposals**: Active proposals in the CVE Quality Working Group seek to expand software identity options by introducing generic identifier support alongside dedicated additions for purl and Omnibore. - **Authority and Ecosystem Governance**: The panel addresses whether CNAs should be mandated to provide identifiers, the role of Authorized Data Publishers (ADPs) in enriching records, and handling downstream vendor impacts.

### Technical Details - **Defined vs. Inherent Identifiers**: Citing CISA's software identification ecosystem option analysis taxonomy, the panel contrasts defined identifiers (which depend on a central dictionary or list, such as CPE or purl's types list) with inherent identifiers like Omnibore, which are derived deterministically from the artifact itself. - **Identifier Granularity Funnel**: Steve Springett describes an identifier funnel where CPE operates at the broad product level at the top, purl operates in the middle at the package level, and Omnibore operates at the bottom for precise artifact-level tracking. - **Version Constraints and Ranges**: Addressing concerns about purl lacking native version range matching in vulnerability contexts, panelists explain that CVE record proposals separate the package identifier from version constraint fields—reusing the CPE range model (e.g., starting/ending version bounds) rather than requiring multiple explicit purls. - **Non-Package-Manager and Commercial Software**: For software outside traditional package registries (such as C/C++ or commercial software), purl supports extensible types like GitHub/Bitbucket or the SWID purl type, which adapts ISO SWID tag attributes into a decentralized package URL. - **CPE Modernization and Scaling**: CPE 2.3 faces challenges scaling across tens of thousands of product iterations. NVD is working toward modernizing CPE serialization from XML to JSON and exploring expanded automated tooling.

### Takeaways - **A Multi-Identifier Future is Inevitable**: Industry participants and standards bodies recognize that different layers of the software supply chain require different identification granularities—from products (CPE) to packages (purl) to binaries/artifacts (Omnibore). - **Support over Mandates**: The CVE program focuses on enabling industry-standard identifiers within CVE records rather than dictating a mandatory standard, avoiding insurmountable barriers for participating CNAs. - **Evolving Community Standards**: Both purl (via ECMA TC54) and Omnibore are actively developing open specifications, implementations, and cross-reference mappings, while NVD continues working on modernization and tooling improvements.