Black Duck SCA provides detailed information on a security vulnerability depending on whether you are viewing:
European Vulnerability Database (EUVD) Records
The European Vulnerability Database (EUVD) is a resource that catalogs vulnerabilities reported in software products across Europe. It serves as a valuable reference for security teams seeking to understand the vulnerabilities impacting their systems, including those not covered by other databases.
Finding EUVD Records in Black Duck SCA
In Black Duck SCA, when viewing a vulnerability record (such as a CVE), you may see an EUVD ID displayed in the page header if a related EUVD record exists. This ID indicates that there are additional details available in the EUVD regarding the vulnerability.
Accessing EUVD Information
When you click on the EUVD ID link in the vulnerability record, you will be redirected to the EUVD website. There, you can find comprehensive information about the related vulnerability, including descriptions, severity ratings, and any remediation recommendations.
CVE Numbering Authorities (CNA)
Black Duck SCA now ingests NVD CNA (CVE Numbering Authorities) vulnerability scores, enhancing our ability to provide comprehensive vulnerability assessments. When the NVD has not provided its own score for a CVE record, a secondary CNA score will be displayed in Black Duck SCA
Benefits of CNA Scores
The incorporation of CNA scores means there will be fewer CVE vulnerabilities without a CVSS score. Additionally, the speed at which vulnerability scores are published will improve, as CNA scores are often published ahead of NVD scores. This improvement allows organizations to respond more swiftly to vulnerabilities.
User Experience
Customers do not need to make any changes to see the new CNA scores; this feature was implemented as part of an update to our KnowledgeBase. Users will benefit from CNA scores automatically without needing to upgrade.
Future Enhancements
In a future Black Duck SCA release, we will enhance our UI, APIs, and vulnerability reports to highlight the origin of CVE scores, including the CNA name. This will provide greater transparency and clarity in vulnerability management.
Understanding CNA Scores
See the flow diagram below, which explains when and how a CVE score is chosen. Note that customers cannot change the security risk ranking around CNA score priority.