# Ubuntu VEX / OSV Format Research (2026-08-26)
AI Summary
Purpose:
- Record verified facts about Canonical's Ubuntu vulnerability data formats,
gathered to ground the multi-OS extension of the RHEL VEX v4 design (Confluence DT/4222189689).
Key points:
- Ubuntu publishes VEX in the OpenVEX spec (not CSAF like Red Hat).
One JSON file per CVE at vex/cve/{YYYY}/CVE-YYYY-NNNN.json in the canonical/ubuntu-security-notices GitHub repo, plus USN-level files and a tarball on security-metadata.canonical.com. File names have no UBUNTU- prefix (that prefix is OSV-only).
- Product identification is purl, no CPE:
pkg:deb/ubuntu/[email protected]?arch=arm64&distro=jammy. Release is the distro= codename; the fixed version is the purl @ version (no separate fixed-version field). Statements enumerate binary packages × architectures (arch explosion like Red Hat composite ids).
- OpenVEX statuses:
fixed/affected/not_affected/
under_investigation, plus status_notes and justification fields.
- The verified sample (CVE-2024-42472, the RHEL bubblewrap golden-set CVE)
is tracked in Ubuntu as flatpak: focal fixed 1.6.5-0ubuntu0.5, jammy fixed 1.12.7-1ubuntu0.1, noble fixed 1.14.6-1ubuntu0.1, bionic no fix (ESM-era release).
- OSV counterpart (
osv/cve/{YYYY}/UBUNTU-CVE-*.json) is **source-package
based** (arch=source) with ecosystem strings Ubuntu:22.04:LTS; the OSV schema defines Ubuntu:Pro:18.04:LTS for the Ubuntu Pro/ESM rail — the Ubuntu analog of RHEL EUS/TUS subscriptions. The sampled VEX file carried no Pro/ESM marking, so whether OpenVEX alone can distinguish the ESM rail is Needs confirmation (check samples of CVEs fixed only in ESM).
- Not yet checked: a deletions/withdrawal mechanism (RHEL
deletions.csv
analog), how tracker vocabulary (needed/deferred/ignored) maps into status_notes, and main-vs-universe component visibility.
Relevant when:
- Designing or estimating the Ubuntu collector, or comparing channel-key
options for the multi-OS schema.
Do not read full document unless:
- The exact URLs or example strings are needed; the Details section is short.
Linked documents:
ai/wiki/projects/rhel-vex-vuln-collection.md(open question 10)ai/wiki/projects/vulnerability-collection.md- Confluence DT/4222189689
[os 패키지 취약점 - v4] 멀티 OS 공통 스키마 방안
Open Questions
- Does OpenVEX ever encode the Ubuntu Pro/ESM rail, or must OSV be used for
it? Sample CVEs fixed only in esm-infra/esm-apps to decide.
- Withdrawal/retraction signal for published Ubuntu CVE records.
Details
Verified 2026-08-26 by fetching:
- https://documentation.ubuntu.com/security/security-updates/vex/ — format
is OpenVEX; publication points; status vocabulary.
- https://raw.githubusercontent.com/canonical/ubuntu-security-notices/main/vex/cve/2024/CVE-2024-42472.json
— verbatim product examples: pkg:deb/ubuntu/[email protected]?arch=source&distro=focal, pkg:deb/ubuntu/[email protected]?arch=arm64&distro=jammy, pkg:deb/ubuntu/[email protected]?arch=s390x&distro=noble. Note: vex/cve/2024/UBUNTU-CVE-2024-42472.json is 404 — VEX files use the plain CVE- name.
- https://raw.githubusercontent.com/canonical/ubuntu-security-notices/main/osv/cve/2024/UBUNTU-CVE-2024-42472.json
— four affected entries, ecosystems Ubuntu:18.04:LTS (no fix), Ubuntu:20.04:LTS, Ubuntu:22.04:LTS, Ubuntu:24.04:LTS, purls with arch=source.
- https://ossf.github.io/osv-schema/ — Ubuntu ecosystem grammar, including
the Ubuntu:Pro:18.04:LTS form for ESM.