OASIS Open

Common Security Advisory Framework Version 2.0 CS03 has been presented to the membership by the CSAF TC [1] as a candidate for OASIS Standard. Do you consent or object to its approval as an OS?

This document is the definitive reference for the language elements of CSAF version 2.0. The Common Security Advisory Framework (CSAF) is a language to exchange Security Advisories formulated in JSON.

The term Security Advisory describes any notification of security issues in products to or from product vendors, Product Security Incident Response Teams (PSIRTs), product resellers and distributors, and others. The focus of the term is on the security aspect impacting specific product-platform-version combinations.

The TC received 3 Statements of Use from Oracle Corporation, TIBCO Software Inc., and Federal Office for Information Security (BSI) Germany [2].

This is a call to the Organizational Members of OASIS to consent or object to this approval. You are welcome to register your consent explicitly on the ballot; however your consent is assumed unless you register an objection [3]. To register an objection, you must:

1. Indicate your objection on this ballot, and

2. Provide a reason for your objection and/or a proposed remedy to the TC.

You may provide the reason in the comment box or by email to the Technical Committee on its comment mailing list or, if you are a member of the TC, to the TC's mailing list [4]. If you provide your reason by email, please indicate in the subject line that this is in regard to the Call for Consent. Note that failing to provide a reason and/or remedy may result in an objection being deemed invalid.

URIs:

The Committee Specification is available here:

Common Security Advisory Framework Version 2.0
Committee Specification 03
01 August 2022

Editable source (Authoritative):
https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.md

HTML:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.html

PDF:
https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.pdf

For your convenience, OASIS provides a complete package of the specification document and any related files in ZIP distribution files. You can download the ZIP file at:

https://docs.oasis-open.org/csaf/csaf/v2.0/cs03/csaf-v2.0-cs03.zip

Please contact OASIS TC Administration at tc-admin@lists.oasis-open.org with any questions you may have about this ballot.

--- Additional information ---

[1] Common Security Advisory Framework (CSAF) TC
https://www.oasis-open.org/committees/csaf/

[2] Statements of use

- Oracle Corporation:
https://lists.oasis-open.org/archives/csaf/202208/msg00002.html

- TIBCO Software Inc.:
https://lists.oasis-open.org/archives/csaf/202208/msg00000.html

- Federal Office for Information Security (BSI) Germany:
https://lists.oasis-open.org/archives/csaf/202207/msg00024.html

[3] https://www.oasis-open.org/policies-guidelines/tc-process-2017-05-26#OScallForConsent

[4] Comments may be submitted to the TC through the use of the OASIS TC Comment Facility as explained in the instructions located at https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=csaf

Comments submitted to the TC are publicly archived and can be viewed at https://lists.oasis-open.org/archives/csaf-comment/

Members of the TC should send comments directly to csaf@lists.oasis-open.org.