How to access the VEX data associated with a DHI image

General
1

hi

We are using Docker Hardened Images (DHI), specifically dhi.io/debian-base, and scanning them with JFrog Xray.

Some CVEs reported by Xray appear to have been marked as not exploitable according to a VEX statement. However, we are unable to determine how to retrieve this VEX information from the image or from Docker.

What is the recommended way to access the VEX data associated with a DHI image?

Additionally, is there a supported method to export or consume this VEX information so that it can be integrated into JFrog Xray reports and vulnerability management workflows?

Any documentation or examples would be appreciated.

Thank you.

2

I can provide a partial answer that covers how to get the vex statements for a dhi.io image:

You can either use the docker cli:

docker scout vex get registry://dhi.io/debian-base:trixie-debian13-dev  --output vex.json

Note: this requires the docker scout cli plugin to be installed (see: https://docs.docker.com/scout/install/). It is pre-packaged with Docker Desktop.

You can also query the VEX statement using the DHI API:

But I can’t really say anything about the JFrog Xray part.

3

I don’t use Jfrog XRay either, but I was curious. Does this link help you?

https://docs.jfrog.com/security/docs/export-scan-results#supported-sbom-formats

Quote:

As of Xray version 3.67.x and above, CycloneDX SBOMs also include VEX (Vulnerability Exploitability Exchange) data, providing:

and
https://docs.jfrog.com/security/docs/sbom-import

Quote:

  • Enrich SBOMs generated from external tools with vulnerability (VEX) and license obligation information.
    ..

How to Import SBOMs to Xray

  1. Upload an SBOM file in one of the supported formats to an indexed generic repository:
    • CycloneDX: .cdx.json or .cdx.xml
    • SPDX: .spdx.json (SPDX 2.x Only)
  2. Once uploaded, Xray automatically indexes and scans the SBOM file.

The scanned SBOM will now appear in your Scans List.