CSAF and VEX data exports

Our machine-readable and automatable documents about security advisories and vulnerabilities in a standard format.

Freexian CSAF and VEX data

Providing our users with accurate information about vulnerabilities and security advisories for the various Debian releases, throughout the whole 10-year lifecycle, is one of the main goals of the Freexian LTS/ELTS services. Moreover, managing and delivering vulnerability data is one of the requirements to comply with cybersecurity regulations and standards. To help users better understand the status of security support on their Debian-based systems, Freexian publishes structured, machine-readable security information using the Common Security Advisory Framework (CSAF) 2.0 standard (which has also been published as ISO/IEC 20153:2025).

The CSAF documents are generated from the Freexian Security Tracker. They can be integrated into vulnerability management, patch management, and software inventory workflows.

Using the CSAF documents

CSAF-aware tools can consume the document feeds to:

  • Determine whether installed Debian packages are affected by a CVE
  • Identify fixed or recommended package versions
  • Enrich vulnerability scanning results
  • Prioritize remediation using the Freexian severity assessment
  • Combine vulnerability data in VEX format (following the CSAF VEX profile) with a Software Bill of Materials (SBOM) document
  • Track advisory changes programmatically

Consumers should match the Package URLs (PURLs) in their software inventory or SBOM against the product identifiers present in the CSAF product tree and vulnerability status fields.

Available data

Freexian provides two types of CSAF documents:

  1. Security advisories
  2. Per-CVE VEX documents

Security advisories

Advisory documents describe security updates announced through:

  • Debian Security Advisories (DSAs)
  • Debian LTS Advisories (DLAs)
  • Extended LTS Advisories (ELAs)

A security advisory can cover multiple CVEs and package versions. Packages updated by an advisory are marked as fixed and recommended in its product status.

Informational advisories may also be published when an announcement does not describe a security or regression update.

Per-CVE VEX documents

A VEX document is generated for each CVE. It describes the status of that vulnerability for relevant Debian package versions and releases. As mentioned above, these documents follow the CSAF VEX Profile format.

Accessing the data

The CSAF provider metadata is available at: https://data.security.freexian.com/.well-known/csaf/provider-metadata.json

All the documents can be listed from https://data.security.freexian.com/csaf/v2/index.html. It advertises the following distributions:

  • Advisories: <https://data.security.freexian.com/csaf/v2/advisories>
  • VEX documents: <https://data.security.freexian.com/csaf/v2/vex>

Documents are organized by year:

  • Advisories: <https://data.security.freexian.com/csaf/v2/advisories/<year>/<advisory-id>.json>
  • VEX documents: <https://data.security.freexian.com/csaf/v2/vex/<year>/<cve-id>.json>

Each distribution also contains the following files:

  • index.txt: available documents and their associated files
  • changes.csv: files and their latest modification times
  • deletions.csv: documents removed from the feed, when applicable

Understanding product identifiers

Products are identified in the CSAF/VEX documents using Package URLs (PURLs). The following is an example PURL for the libssl3 binary package version 3.0.14-1, built for the 64-bit PC (amd64) architecture on Debian 12:

pkg:deb/debian/libssl3@3.0.14-1~deb12u1?arch=amd64&distro=debian-12.7

A product identifier includes:

  • The binary or source package name
  • The Debian package version
  • The architecture
  • The Debian release version
  • The epoch, when the package version has one

The CSAF product tree groups products by vendor and architecture. Source packages use the source architecture. Vulnerability status entries reference binary package PURLs.

Understanding VEX status

The status of a (source) package with respect to a vulnerability is derived from the Debian Security Tracker. The status may be known_affected, known_not_affected, or fixed.

  • known_affected means that the package version is considered vulnerable.

  • known_not_affected means that tracker metadata explicitly marks the package or release as not affected. This status is derived from applicable <not-affected> annotations in the Debian Security Tracker.

  • fixed means that the represented package version contains a fix for the vulnerability.

Fixed products are also listed as recommended in the product_status field, indicating that users should upgrade to that version.

Example:

"product_status": {
    "fixed": [
        "pkg:deb/debian/wolfssl@5.9.2-1?arch=source&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=amd64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=amd64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=arm64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=arm64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=armhf&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=armhf&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=i386&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=i386&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=ppc64el&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=ppc64el&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=riscv64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=riscv64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=s390x&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=s390x&distro=debian-unstable"
    ],
    "recommended": [
        "pkg:deb/debian/wolfssl@5.9.2-1?arch=source&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=amd64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=amd64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=arm64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=arm64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=armhf&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=armhf&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=i386&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=i386&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=ppc64el&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=ppc64el&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=riscv64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=riscv64&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl-dev@5.9.2-1?arch=s390x&distro=debian-unstable",
        "pkg:deb/debian/libwolfssl44@5.9.2-1?arch=s390x&distro=debian-unstable"
    ]
}

Packages lacking sufficient status or package information in the Security Tracker may be omitted from a generated document.

Severity

Severity is represented by the document-level CSAF aggregate_severity field.

For each CVE, Freexian uses:

  1. freexian_severity, when available
  2. calculated_severity as a fallback

Supported values are:

  • None
  • Low
  • Medium
  • High
  • Critical

For a per-CVE VEX document, the aggregate severity is the severity of that CVE; for an advisory covering multiple CVEs, it is the highest severity among them.

The current feed does not publish numeric CVSS scores in the CSAF vulnerabilities[].scores field.

Vulnerability information

Depending on the available source data, vulnerability entries can include:

  • The CVE identifier
  • A vulnerability description
  • A link to the Security Tracker
  • Security Tracker notes
  • References to Debian bug reports
  • Product status information
  • Vulnerability mitigations

Authenticity and integrity

To allow consumers to verify the authenticity and integrity of the exports, each JSON document is accompanied by:

  • A SHA-512 checksum (identified by a .sha512 file suffix)
  • An OpenPGP detached signature (identified by a .asc file suffix)

The Freexian public signing key is available at: https://data.security.freexian.com/.well-known/csaf/public_key.asc

The expected fingerprint is:

486E 85E9 0329 0736 A782 38CA 244D 8810 FFB7 6B82

Consumers should verify both the checksum and signature before processing a document.

Current limitations

The generated data currently has the following limitations:

  • A document can only describe packages and releases for which sufficient Security Tracker and archive metadata is available.
  • Severity is document-level. For advisories containing multiple CVEs, it represents the highest available severity.
  • Status accuracy depends on the corresponding Debian Security Tracker data.

CVSS vectors and numeric CVSS scores are not yet published; they will be added in the future for supported packages.

Reporting issues

To report missing, incorrect, or inconsistent data, please contact lts-coordinator@freexian.com.

Please include the advisory or CVE identifier and the affected product PURL where possible.