Support known-exploited-vulnerability catalogs (CISA KEV) as an enrichment source

[waldemar-kindler]

Support known-exploited-vulnerability catalogs (CISA KEV) as an enrichment source

Summary

Trustify currently answers "which of my SBOM components are affected by which vulnerabilities", but offers no signal for the natural follow-up: "which of these are actually being exploited in the wild?" The CISA Known Exploited Vulnerabilities (KEV) catalog is the authoritative, curated source for that signal (~1,300 CVEs, each with confirmed active exploitation). Ingesting it would let users prioritize the handful of findings that matter most, and supports concrete compliance drivers:

• BOD 22-01 (US federal): mandated remediation deadlines for KEV-listed CVEs (dueDate is part of the feed).
• FDA premarket cybersecurity guidance (medical devices): KEV-listed vulnerabilities "should be designed out of the device".
• EU CRA reporting on actively exploited vulnerabilities.

Why KEV is not redundant with CVSS/EPSS

Empirical analysis in DependencyTrack/dependency-track#2267 showed EPSS scores frequently decrease over time (e.g. CVE-2020-13158 dropped 0.97 → 0.018 in two days), so probabilistic scores cannot substitute for the durable "was exploited in the wild" fact. CVSS measures theoretical severity, not exploitation. KEV is a trailing indicator that complements both.

Design considerations (informed by prior art)

Lessons from DependencyTrack #2267 (open since 2022) and google/osv-scalibr #2194:

1. Don't be CISA-specific. Model this as a generic "known exploited" enrichment with KEV as the first source. Realistic additional sources: VulnCheck KEV (free community feed, superset of CISA KEV, adds ransomware-campaign usage and exploit references; requires prominent attribution), a future ENISA/EU vulnerability database under CRA, inthewild.io.
2. Store the metadata, not just a flag. dateAdded, dueDate, requiredAction, knownRansomwareCampaignUse are what make the data actionable (deadline tracking, reporting). Suggests a vulnerability-linked table (known_exploited_vulnerability or similar, keyed by CVE ID + source) rather than a boolean column on vulnerability.
3. Handle removals. CISA has removed entries from KEV before (e.g. the 2023 Iconics reversal). Each import must be a full sync of the catalog, not append-only.
4. Matching is trivial. KEV entries carry standard CVE IDs, which map directly onto trustify's vulnerability.id. No range/version matching is needed — KEV asserts exploitation of the CVE, not of specific product versions.

Proposed scope (v1)

Keep it deliberately small — prior art suggests this feature grows quickly if not scoped tightly:

1. New importer following the existing pattern in modules/importer/src/runner/ (cf. cwe, clearly_defined), periodically fetching the single unauthenticated JSON feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (also mirrored under CC0 at cisagov/kev-data).
2. New table storing KEV entries linked to vulnerabilities by CVE ID (source-qualified to allow future providers), full-sync semantics.
3. Expose the data on the vulnerability API (details/list), filterable/sortable, so UI and API consumers can answer "which of my findings are known-exploited?"

Explicit non-goals for v1

• Risk-score adjustments derived from KEV membership.
• VulnCheck or other additional providers (the data model should merely not preclude them).
• Dedicated UI views/dashboards (follow-up once the data is queryable).
• Extracting SSVC exploitation values from CISA vulnrichment ADP containers in the CVE loader — related but separate enrichment path, possible follow-up.

Feed details

• Format: JSON, fields per entry: cveID, vendorProject, product, vulnerabilityName, dateAdded, shortDescription, requiredAction, dueDate, knownRansomwareCampaignUse, notes, cwes.
• Size: ~1,300 entries, single small file, updated multiple times per week.
• License: US Government work / CC0 via the GitHub mirror — no attribution constraints (unlike VulnCheck).

I'm happy to take this on and submit a PR.