Ubuntu VEX data feed

Improve visibility and vulnerability tracking in your codebase by consuming Ubuntu’s Vulnerability Exploitability eXchange (VEX) data - a structured, human and machine readable format describing known vulnerabilities and available security patches for all supported Ubuntu releases. Ubuntu’s VEX data currently follows the OpenVEX specification, a minimal, compliant, interoperable, embeddable and open source implementation of VEX.

What is VEX?

Developer working at desk

Vulnerability Exploitability eXchange (VEX) is a type of security advisory, represented as a JSON-based schema. It describes the exploitability status of vulnerabilities across open source software ecosystems, focusing on clarifying whether known vulnerabilities are exploitable in specific configurations or not.

When to use VEX

As organizations adopt software bills of materials (SBOMs) to track components in their software, they face the challenge of determining which vulnerabilities identified in these inventories are actually exploitable. SBOMs provide transparency by listing all dependencies, but without contextual information, they often flag vulnerabilities that are not relevant to the deployed environment, which leads to false alarms.

VEX addresses this gap by providing clear exploitability status for vulnerabilities. It helps organizations prioritize security actions by identifying which vulnerabilities are exploitable based on the system’s configuration, or mitigations (e.g. patches) that are already in place. This integration transforms SBOM data from static inventories into dynamic and actionable items, enabling efficient patching, compliance assurance, and stronger security overall.

What types of Ubuntu VEX data are available?

Currently, Ubuntu’s Security Team produces Ubuntu VEX data for two different types of vulnerability data:

Where can I get the data from?

Ubuntu VEX data is available through two different channels:

Are VEX documents versioned?

Yes. Each document has a unique identifier and a version, which gets updated each time the document is edited with new information. Those changes can be seen in Canonical’s GitHub repository, where a history of all the previous versions is stored for each file.

How does Ubuntu VEX data work?

cloud environments, which rely on servers (closeup)

CVE VEX

As software vulnerabilities are discovered, they are assigned CVE identifiers by MITRE and other organizations. Canonical triages these CVEs to determine whether the vulnerabilities affect software distributed within Ubuntu. The results of this triage are then used to generate the first version of the CVE VEX document, which specifies the status of the CVE for every related product in the Ubuntu ecosystem, and every supported release.

After the initial triage, the CVE might be revisited again by the Ubuntu Security team, either to mark it as resolved, or to adapt its status after communication with the team behind the distribution of a specific package. The team may also edit the CVE to add notes and comments about this vulnerability. When any of this happens, a new VEX document is created, with an incremented version, and more information about the new status.

This document can be used to assess the local system for vulnerabilities.

USN VEX

When Ubuntu’s Security Team patches software to address one or more CVEs, an Ubuntu Security Notice (USN) is published announcing the update. USN VEX data is generated from information encapsulated within the USN, and can be used to assess the system for missing patches.

More resources

Vulnerability management in Ubuntu

Learn about vulnerability management tools in Ubuntu to make your processes more efficient.

Ubuntu CVE reports

Access an overview of common vulnerabilities and exposures.

Security features in Ubuntu

Learn more about Ubuntu security maintenance and platform security features.