From 0943cfd9d0940c316791b7e8dbf4bd3e812afacb Mon Sep 17 00:00:00 2001 From: Stefan Hagen Date: Sun, 3 Nov 2024 16:37:10 +0100 Subject: [PATCH] Fixed sec ref, updated maps, and rendered md/html - nit: fixed reference to new/reborn date and time section - updated the mappings for sections and examples - rendered the user facing delivery items: single file markdown and html Signed-off-by: Stefan Hagen --- .../edit/etc/example-global-to-local.json | 252 ++-- .../edit/etc/example-local-to-global.json | 251 ++-- .../edit/etc/section-display-to-label.json | 6 + .../edit/etc/section-label-to-display.json | 6 + csaf_2.1/prose/edit/src/conformance.md | 3 +- csaf_2.1/prose/share/csaf-v2.1-draft.html | 1205 ++++++++++++++--- csaf_2.1/prose/share/csaf-v2.1-draft.md | 782 ++++++++--- 7 files changed, 1897 insertions(+), 608 deletions(-) diff --git a/csaf_2.1/prose/edit/etc/example-global-to-local.json b/csaf_2.1/prose/edit/etc/example-global-to-local.json index e35f3418..e56dbae9 100644 --- a/csaf_2.1/prose/edit/etc/example-global-to-local.json +++ b/csaf_2.1/prose/edit/etc/example-global-to-local.json @@ -28,127 +28,133 @@ "26": "version-type-semantic-versioning-eg-3", "27": "version-type-semantic-versioning-eg-4", "28": "version-type-semantic-versioning-eg-5", - "29": "document-property-aggregate-severity-eg-1", - "30": "document-property-category-eg-1", - "31": "document-property-distribution-text-eg-1", - "32": "document-property-distribution-tlp-eg-1", - "33": "document-property-publisher-contact-details-eg-1", - "34": "document-property-publisher-name-eg-1", - "35": "document-property-publisher-namespace-eg-1", - "36": "document-property-title-eg-1", - "37": "document-property-tracking-aliases-eg-1", - "38": "document-property-tracking-generator-eg-1", - "39": "document-property-tracking-generator-eg-2", - "40": "document-property-tracking-id-eg-1", - "41": "product-tree-property-product-groups-eg-1", - "42": "product-tree-property-relationships-eg-1", - "43": "vulnerabilities-property-cwes-eg-1", - "44": "vulnerabilities-property-cwes-eg-2", - "45": "vulnerabilities-property-cwes-eg-3", - "46": "vulnerabilities-property-ids-eg-1", - "47": "vulnerabilities-property-ids-eg-2", - "48": "filename-eg-1", - "49": "filename-eg-2", - "50": "missing-definition-of-product-id-eg-1", - "51": "multiple-definition-of-product-id-eg-1", - "52": "circular-definition-of-product-id-eg-1", - "53": "missing-definition-of-product-group-id-eg-1", - "54": "multiple-definition-of-product-group-id-eg-1", - "55": "contradicting-product-status-eg-1", - "56": "multiple-scores-with-same-version-per-product-eg-1", - "57": "invalid-cvss-eg-1", - "58": "invalid-cvss-computation-eg-1", - "59": "inconsistent-cvss-eg-1", - "60": "cwe-eg-1", - "61": "language-eg-1", - "62": "purl-eg-1", - "63": "sorted-revision-history-eg-1", - "64": "translator-eg-1", - "65": "latest-document-version-eg-1", - "66": "document-status-draft-eg-1", - "67": "released-revision-history-eg-1", - "68": "revision-history-entries-for-pre-release-versions-eg-1", - "69": "non-draft-document-version-eg-1", - "70": "missing-item-in-revision-history-eg-1", - "71": "multiple-definition-in-revision-history-eg-1", - "72": "multiple-use-of-same-cve-eg-1", - "73": "multiple-definition-in-involvements-eg-1", - "74": "multiple-use-of-same-hash-algorithm-eg-1", - "75": "prohibited-document-category-name-eg-1", - "76": "prohibited-document-category-name-eg-2", - "77": "document-notes-eg-1", - "78": "document-references-eg-1", - "79": "vulnerabilities-for-informational-advisory-eg-1", - "80": "product-tree-eg-1", - "81": "vulnerability-notes-eg-1", - "82": "product-status-eg-1", - "83": "vex-product-status-eg-1", - "84": "vulnerability-id-eg-1", - "85": "impact-statement-eg-1", - "86": "action-statement-eg-1", - "87": "vulnerabilities-for-security-advisory-or-vex-eg-1", - "88": "translation-eg-1", - "89": "remediation-without-product-reference-eg-1", - "90": "mixed-integer-and-semantic-versioning-eg-1", - "91": "version-range-in-product-version-eg-1", - "92": "flag-without-product-reference-eg-1", - "93": "multiple-flags-with-vex-justification-codes-per-product-eg-1", - "94": "unused-definition-of-product-id-eg-1", - "95": "missing-remediation-eg-1", - "96": "missing-metric-eg-1", - "97": "build-metadata-in-revision-history-eg-1", - "98": "older-initial-release-date-than-revision-history-eg-1", - "99": "older-current-release-date-than-revision-history-eg-1", - "100": "missing-date-in-involvements-eg-1", - "101": "use-of-md5-as-the-only-hash-algorithm-eg-1", - "102": "use-of-sha-1-as-the-only-hash-algorithm-eg-1", - "103": "missing-tlp-label-eg-1", - "104": "missing-canonical-url-eg-1", - "105": "missing-document-language-eg-1", - "106": "optional-tests--sorting-eg-1", - "107": "use-of-private-language-eg-1", - "108": "use-of-default-language-eg-1", - "109": "missing-product-identification-helper-eg-1", - "110": "cve-in-field-ids-eg-1", - "111": "product-version-range-without-vers-eg-1", - "112": "cvss-for-fixed-products-eg-1", - "113": "additional-properties-eg-1", - "114": "same-timestamps-in-revision-history-eg-1", - "115": "document-tracking-id-in-title-eg-1", - "116": "usage-of-deprecated-cwe-eg-1", - "117": "usage-of-non-latest-cwe-version-eg-1", - "118": "usage-of-cwe-not-allowed-for-vulnerability-mapping-eg-1", - "119": "usage-of-cwe-allowed-with-review-for-vulnerability-mapping-eg-1", - "120": "use-of-cvss-v2-as-the-only-scoring-system-eg-1", - "121": "use-of-cvss-v3-0-eg-1", - "122": "missing-cve-eg-1", - "123": "missing-cwe-eg-1", - "124": "use-of-short-hash-eg-1", - "125": "use-of-non-self-referencing-urls-failing-to-resolve-eg-1", - "126": "use-of-self-referencing-urls-failing-to-resolve-eg-1", - "127": "spell-check-eg-1", - "128": "branch-categories-eg-1", - "129": "usage-of-product-version-range-eg-1", - "130": "usage-of-v-as-version-indicator-eg-1", - "131": "missing-cvss-v4-0-eg-1", - "132": "requirement-7-provider-metadata-json-eg-1", - "133": "requirement-8-security-txt-eg-1", - "134": "requirement-9-well-known-url-for-provider-metadata-json-eg-1", - "135": "requirement-11-one-folder-per-year-eg-1", - "136": "requirement-12-index-txt-eg-1", - "137": "requirement-13-changes-csv-eg-1", - "138": "requirement-15-rolie-feed-eg-1", - "139": "requirement-16-rolie-service-document-eg-1", - "140": "requirement-17-rolie-category-document-eg-1", - "141": "requirement-17-rolie-category-document-eg-2", - "142": "requirement-17-rolie-category-document-eg-3", - "143": "requirement-18-integrity-eg-1", - "144": "requirement-18-integrity-eg-2", - "145": "requirement-19-signatures-eg-1", - "146": "requirement-21-list-of-csaf-providers-eg-1", - "147": "requirement-23-mirror-eg-1", - "148": "conformance-clause-5-cvrf-csaf-converter-eg-1", - "149": "conformance-clause-5-cvrf-csaf-converter-eg-2", - "150": "conformance-clause-5-cvrf-csaf-converter-eg-3", - "151": "conformance-clause-5-cvrf-csaf-converter-eg-4" + "29": "version-type-semantic-versioning-eg-6", + "30": "document-property-aggregate-severity-eg-1", + "31": "document-property-category-eg-1", + "32": "document-property-distribution-text-eg-1", + "33": "document-property-distribution-tlp-eg-1", + "34": "document-property-publisher-contact-details-eg-1", + "35": "document-property-publisher-name-eg-1", + "36": "document-property-publisher-namespace-eg-1", + "37": "document-property-title-eg-1", + "38": "document-property-tracking-aliases-eg-1", + "39": "document-property-tracking-generator-eg-1", + "40": "document-property-tracking-generator-eg-2", + "41": "document-property-tracking-id-eg-1", + "42": "product-tree-property-product-groups-eg-1", + "43": "product-tree-property-relationships-eg-1", + "44": "vulnerabilities-property-cwes-eg-1", + "45": "vulnerabilities-property-cwes-eg-2", + "46": "vulnerabilities-property-cwes-eg-3", + "47": "vulnerabilities-property-ids-eg-1", + "48": "vulnerabilities-property-ids-eg-2", + "49": "filename-eg-1", + "50": "filename-eg-2", + "51": "missing-definition-of-product-id-eg-1", + "52": "multiple-definition-of-product-id-eg-1", + "53": "circular-definition-of-product-id-eg-1", + "54": "missing-definition-of-product-group-id-eg-1", + "55": "multiple-definition-of-product-group-id-eg-1", + "56": "contradicting-product-status-eg-1", + "57": "multiple-scores-with-same-version-per-product-eg-1", + "58": "invalid-cvss-eg-1", + "59": "invalid-cvss-computation-eg-1", + "60": "inconsistent-cvss-eg-1", + "61": "cwe-eg-1", + "62": "language-eg-1", + "63": "purl-eg-1", + "64": "sorted-revision-history-eg-1", + "65": "translator-eg-1", + "66": "latest-document-version-eg-1", + "67": "document-status-draft-eg-1", + "68": "released-revision-history-eg-1", + "69": "revision-history-entries-for-pre-release-versions-eg-1", + "70": "non-draft-document-version-eg-1", + "71": "missing-item-in-revision-history-eg-1", + "72": "multiple-definition-in-revision-history-eg-1", + "73": "multiple-use-of-same-cve-eg-1", + "74": "multiple-definition-in-involvements-eg-1", + "75": "multiple-use-of-same-hash-algorithm-eg-1", + "76": "prohibited-document-category-name-eg-1", + "77": "prohibited-document-category-name-eg-2", + "78": "document-notes-eg-1", + "79": "document-references-eg-1", + "80": "vulnerabilities-for-informational-advisory-eg-1", + "81": "product-tree-eg-1", + "82": "vulnerability-notes-eg-1", + "83": "product-status-eg-1", + "84": "vex-product-status-eg-1", + "85": "vulnerability-id-eg-1", + "86": "impact-statement-eg-1", + "87": "action-statement-eg-1", + "88": "vulnerabilities-for-security-advisory-or-vex-eg-1", + "89": "translation-eg-1", + "90": "remediation-without-product-reference-eg-1", + "91": "mixed-integer-and-semantic-versioning-eg-1", + "92": "version-range-in-product-version-eg-1", + "93": "flag-without-product-reference-eg-1", + "94": "multiple-flags-with-vex-justification-codes-per-product-eg-1", + "95": "mandatory-tests--branches-recursion-depth-eg-1", + "96": "contradicting-remediations-eg-1", + "97": "contradicting-product-status-remediation-combination-eg-1", + + "98": "unused-definition-of-product-id-eg-1", + "99": "missing-remediation-eg-1", + "100": "missing-metric-eg-1", + "101": "build-metadata-in-revision-history-eg-1", + "102": "older-initial-release-date-than-revision-history-eg-1", + "103": "older-current-release-date-than-revision-history-eg-1", + "104": "missing-date-in-involvements-eg-1", + "105": "use-of-md5-as-the-only-hash-algorithm-eg-1", + "106": "use-of-sha-1-as-the-only-hash-algorithm-eg-1", + "107": "missing-tlp-label-eg-1", + "108": "missing-canonical-url-eg-1", + "109": "missing-document-language-eg-1", + "110": "optional-tests--sorting-eg-1", + "111": "use-of-private-language-eg-1", + "112": "use-of-default-language-eg-1", + "113": "missing-product-identification-helper-eg-1", + "114": "cve-in-field-ids-eg-1", + "115": "product-version-range-without-vers-eg-1", + "116": "cvss-for-fixed-products-eg-1", + "117": "additional-properties-eg-1", + "118": "same-timestamps-in-revision-history-eg-1", + "119": "document-tracking-id-in-title-eg-1", + "120": "usage-of-deprecated-cwe-eg-1", + "121": "usage-of-non-latest-cwe-version-eg-1", + "122": "usage-of-cwe-not-allowed-for-vulnerability-mapping-eg-1", + "123": "usage-of-cwe-allowed-with-review-for-vulnerability-mapping-eg-1", + "124": "discouraged-product-status-remediation-combination-eg-1", + "125": "use-of-cvss-v2-as-the-only-scoring-system-eg-1", + "126": "use-of-cvss-v3-0-eg-1", + "127": "missing-cve-eg-1", + "128": "missing-cwe-eg-1", + "129": "use-of-short-hash-eg-1", + "130": "use-of-non-self-referencing-urls-failing-to-resolve-eg-1", + "131": "use-of-self-referencing-urls-failing-to-resolve-eg-1", + "132": "spell-check-eg-1", + "133": "branch-categories-eg-1", + "134": "usage-of-product-version-range-eg-1", + "135": "usage-of-v-as-version-indicator-eg-1", + "136": "missing-cvss-v4-0-eg-1", + "137": "requirement-7-provider-metadata-json-eg-1", + "138": "requirement-8-security-txt-eg-1", + "139": "requirement-9-well-known-url-for-provider-metadata-json-eg-1", + "140": "requirement-11-one-folder-per-year-eg-1", + "141": "requirement-12-index-txt-eg-1", + "142": "requirement-13-changes-csv-eg-1", + "143": "requirement-15-rolie-feed-eg-1", + "144": "requirement-16-rolie-service-document-eg-1", + "145": "requirement-17-rolie-category-document-eg-1", + "146": "requirement-17-rolie-category-document-eg-2", + "147": "requirement-17-rolie-category-document-eg-3", + "148": "requirement-18-integrity-eg-1", + "149": "requirement-18-integrity-eg-2", + "150": "requirement-19-signatures-eg-1", + "151": "requirement-21-list-of-csaf-providers-eg-1", + "152": "requirement-23-mirror-eg-1", + "153": "conformance-clause-5-cvrf-csaf-converter-eg-1", + "154": "conformance-clause-5-cvrf-csaf-converter-eg-2", + "155": "conformance-clause-5-cvrf-csaf-converter-eg-3", + "156": "conformance-clause-5-cvrf-csaf-converter-eg-4" } diff --git a/csaf_2.1/prose/edit/etc/example-local-to-global.json b/csaf_2.1/prose/edit/etc/example-local-to-global.json index e1d5a5a1..b5dddb86 100644 --- a/csaf_2.1/prose/edit/etc/example-local-to-global.json +++ b/csaf_2.1/prose/edit/etc/example-local-to-global.json @@ -3,43 +3,46 @@ "acknowledgments-type-names-eg-1": "1", "acknowledgments-type-organization-eg-1": "2", "acknowledgments-type-summary-eg-1": "3", - "action-statement-eg-1": "86", - "additional-properties-eg-1": "113", - "branch-categories-eg-1": "128", + "action-statement-eg-1": "87", + "additional-properties-eg-1": "117", + "branch-categories-eg-1": "133", "branches-type-name-eg-1": "5", "branches-type-name-under-product-version-eg-1": "6", "branches-type-name-under-product-version-eg-2": "7", "branches-type-name-under-product-version-range-eg-1": "8", "branches-type-name-under-product-version-range-eg-2": "9", - "build-metadata-in-revision-history-eg-1": "97", - "circular-definition-of-product-id-eg-1": "52", - "conformance-clause-5-cvrf-csaf-converter-eg-1": "148", - "conformance-clause-5-cvrf-csaf-converter-eg-2": "149", - "conformance-clause-5-cvrf-csaf-converter-eg-3": "150", - "conformance-clause-5-cvrf-csaf-converter-eg-4": "151", - "contradicting-product-status-eg-1": "55", - "cve-in-field-ids-eg-1": "110", - "cvss-for-fixed-products-eg-1": "112", - "cwe-eg-1": "60", - "document-notes-eg-1": "77", - "document-property-aggregate-severity-eg-1": "29", - "document-property-category-eg-1": "30", - "document-property-distribution-text-eg-1": "31", - "document-property-distribution-tlp-eg-1": "32", - "document-property-publisher-contact-details-eg-1": "33", - "document-property-publisher-name-eg-1": "34", - "document-property-publisher-namespace-eg-1": "35", - "document-property-title-eg-1": "36", - "document-property-tracking-aliases-eg-1": "37", - "document-property-tracking-generator-eg-1": "38", - "document-property-tracking-generator-eg-2": "39", - "document-property-tracking-id-eg-1": "40", - "document-references-eg-1": "78", - "document-status-draft-eg-1": "66", - "document-tracking-id-in-title-eg-1": "115", - "filename-eg-1": "48", - "filename-eg-2": "49", - "flag-without-product-reference-eg-1": "92", + "build-metadata-in-revision-history-eg-1": "101", + "circular-definition-of-product-id-eg-1": "53", + "conformance-clause-5-cvrf-csaf-converter-eg-1": "153", + "conformance-clause-5-cvrf-csaf-converter-eg-2": "154", + "conformance-clause-5-cvrf-csaf-converter-eg-3": "155", + "conformance-clause-5-cvrf-csaf-converter-eg-4": "156", + "contradicting-product-status-eg-1": "56", + "contradicting-product-status-remediation-combination-eg-1": "97", + "contradicting-remediations-eg-1": "96", + "cve-in-field-ids-eg-1": "114", + "cvss-for-fixed-products-eg-1": "116", + "cwe-eg-1": "61", + "discouraged-product-status-remediation-combination-eg-1": "124", + "document-notes-eg-1": "78", + "document-property-aggregate-severity-eg-1": "30", + "document-property-category-eg-1": "31", + "document-property-distribution-text-eg-1": "32", + "document-property-distribution-tlp-eg-1": "33", + "document-property-publisher-contact-details-eg-1": "34", + "document-property-publisher-name-eg-1": "35", + "document-property-publisher-namespace-eg-1": "36", + "document-property-title-eg-1": "37", + "document-property-tracking-aliases-eg-1": "38", + "document-property-tracking-generator-eg-1": "39", + "document-property-tracking-generator-eg-2": "40", + "document-property-tracking-id-eg-1": "41", + "document-references-eg-1": "79", + "document-status-draft-eg-1": "67", + "document-tracking-id-in-title-eg-1": "119", + "filename-eg-1": "49", + "filename-eg-2": "50", + "flag-without-product-reference-eg-1": "93", "full-product-name-type-name-eg-1": "10", "full-product-name-type-product-identification-helper-generic-uris-eg-1": "16", "full-product-name-type-product-identification-helper-generic-uris-eg-2": "17", @@ -48,107 +51,109 @@ "full-product-name-type-product-identification-helper-hashes-eg-3": "13", "full-product-name-type-product-identification-helper-model-numbers-eg-1": "14", "full-product-name-type-product-identification-helper-sbom-urls-eg-1": "15", - "impact-statement-eg-1": "85", - "inconsistent-cvss-eg-1": "59", - "invalid-cvss-computation-eg-1": "58", - "invalid-cvss-eg-1": "57", - "language-eg-1": "61", + "impact-statement-eg-1": "86", + "inconsistent-cvss-eg-1": "60", + "invalid-cvss-computation-eg-1": "59", + "invalid-cvss-eg-1": "58", + "language-eg-1": "62", "language-type-eg-1": "18", - "latest-document-version-eg-1": "65", - "missing-canonical-url-eg-1": "104", - "missing-cve-eg-1": "122", - "missing-cvss-v4-0-eg-1": "131", - "missing-cwe-eg-1": "123", - "missing-date-in-involvements-eg-1": "100", - "missing-definition-of-product-group-id-eg-1": "53", - "missing-definition-of-product-id-eg-1": "50", - "missing-document-language-eg-1": "105", - "missing-item-in-revision-history-eg-1": "70", - "missing-metric-eg-1": "96", - "missing-product-identification-helper-eg-1": "109", - "missing-remediation-eg-1": "95", - "missing-tlp-label-eg-1": "103", - "mixed-integer-and-semantic-versioning-eg-1": "90", - "multiple-definition-in-involvements-eg-1": "73", - "multiple-definition-in-revision-history-eg-1": "71", - "multiple-definition-of-product-group-id-eg-1": "54", - "multiple-definition-of-product-id-eg-1": "51", - "multiple-flags-with-vex-justification-codes-per-product-eg-1": "93", - "multiple-scores-with-same-version-per-product-eg-1": "56", - "multiple-use-of-same-cve-eg-1": "72", - "multiple-use-of-same-hash-algorithm-eg-1": "74", - "non-draft-document-version-eg-1": "69", + "latest-document-version-eg-1": "66", + "mandatory-tests--branches-recursion-depth-eg-1": "95", + "missing-canonical-url-eg-1": "108", + "missing-cve-eg-1": "127", + "missing-cvss-v4-0-eg-1": "136", + "missing-cwe-eg-1": "128", + "missing-date-in-involvements-eg-1": "104", + "missing-definition-of-product-group-id-eg-1": "54", + "missing-definition-of-product-id-eg-1": "51", + "missing-document-language-eg-1": "109", + "missing-item-in-revision-history-eg-1": "71", + "missing-metric-eg-1": "100", + "missing-product-identification-helper-eg-1": "113", + "missing-remediation-eg-1": "99", + "missing-tlp-label-eg-1": "107", + "mixed-integer-and-semantic-versioning-eg-1": "91", + "multiple-definition-in-involvements-eg-1": "74", + "multiple-definition-in-revision-history-eg-1": "72", + "multiple-definition-of-product-group-id-eg-1": "55", + "multiple-definition-of-product-id-eg-1": "52", + "multiple-flags-with-vex-justification-codes-per-product-eg-1": "94", + "multiple-scores-with-same-version-per-product-eg-1": "57", + "multiple-use-of-same-cve-eg-1": "73", + "multiple-use-of-same-hash-algorithm-eg-1": "75", + "non-draft-document-version-eg-1": "70", "notes-type-eg-1": "19", "notes-type-eg-2": "20", - "older-current-release-date-than-revision-history-eg-1": "99", - "older-initial-release-date-than-revision-history-eg-1": "98", - "optional-tests--sorting-eg-1": "106", + "older-current-release-date-than-revision-history-eg-1": "103", + "older-initial-release-date-than-revision-history-eg-1": "102", + "optional-tests--sorting-eg-1": "110", "product-group-id-type-eg-1": "21", "product-id-type-eg-1": "22", - "product-status-eg-1": "82", - "product-tree-eg-1": "80", - "product-tree-property-product-groups-eg-1": "41", - "product-tree-property-relationships-eg-1": "42", - "product-version-range-without-vers-eg-1": "111", - "prohibited-document-category-name-eg-1": "75", - "prohibited-document-category-name-eg-2": "76", - "purl-eg-1": "62", - "released-revision-history-eg-1": "67", - "remediation-without-product-reference-eg-1": "89", - "requirement-11-one-folder-per-year-eg-1": "135", - "requirement-12-index-txt-eg-1": "136", - "requirement-13-changes-csv-eg-1": "137", - "requirement-15-rolie-feed-eg-1": "138", - "requirement-16-rolie-service-document-eg-1": "139", - "requirement-17-rolie-category-document-eg-1": "140", - "requirement-17-rolie-category-document-eg-2": "141", - "requirement-17-rolie-category-document-eg-3": "142", - "requirement-18-integrity-eg-1": "143", - "requirement-18-integrity-eg-2": "144", - "requirement-19-signatures-eg-1": "145", - "requirement-21-list-of-csaf-providers-eg-1": "146", - "requirement-23-mirror-eg-1": "147", - "requirement-7-provider-metadata-json-eg-1": "132", - "requirement-8-security-txt-eg-1": "133", - "requirement-9-well-known-url-for-provider-metadata-json-eg-1": "134", - "revision-history-entries-for-pre-release-versions-eg-1": "68", - "same-timestamps-in-revision-history-eg-1": "114", - "sorted-revision-history-eg-1": "63", - "spell-check-eg-1": "127", - "translation-eg-1": "88", - "translator-eg-1": "64", + "product-status-eg-1": "83", + "product-tree-eg-1": "81", + "product-tree-property-product-groups-eg-1": "42", + "product-tree-property-relationships-eg-1": "43", + "product-version-range-without-vers-eg-1": "115", + "prohibited-document-category-name-eg-1": "76", + "prohibited-document-category-name-eg-2": "77", + "purl-eg-1": "63", + "released-revision-history-eg-1": "68", + "remediation-without-product-reference-eg-1": "90", + "requirement-11-one-folder-per-year-eg-1": "140", + "requirement-12-index-txt-eg-1": "141", + "requirement-13-changes-csv-eg-1": "142", + "requirement-15-rolie-feed-eg-1": "143", + "requirement-16-rolie-service-document-eg-1": "144", + "requirement-17-rolie-category-document-eg-1": "145", + "requirement-17-rolie-category-document-eg-2": "146", + "requirement-17-rolie-category-document-eg-3": "147", + "requirement-18-integrity-eg-1": "148", + "requirement-18-integrity-eg-2": "149", + "requirement-19-signatures-eg-1": "150", + "requirement-21-list-of-csaf-providers-eg-1": "151", + "requirement-23-mirror-eg-1": "152", + "requirement-7-provider-metadata-json-eg-1": "137", + "requirement-8-security-txt-eg-1": "138", + "requirement-9-well-known-url-for-provider-metadata-json-eg-1": "139", + "revision-history-entries-for-pre-release-versions-eg-1": "69", + "same-timestamps-in-revision-history-eg-1": "118", + "sorted-revision-history-eg-1": "64", + "spell-check-eg-1": "132", + "translation-eg-1": "89", + "translator-eg-1": "65", "typographical-conventions-eg-1": "4321", - "unused-definition-of-product-id-eg-1": "94", - "usage-of-cwe-allowed-with-review-for-vulnerability-mapping-eg-1": "119", - "usage-of-cwe-not-allowed-for-vulnerability-mapping-eg-1": "118", - "usage-of-deprecated-cwe-eg-1": "116", - "usage-of-non-latest-cwe-version-eg-1": "117", - "usage-of-product-version-range-eg-1": "129", - "usage-of-v-as-version-indicator-eg-1": "130", - "use-of-cvss-v2-as-the-only-scoring-system-eg-1": "120", - "use-of-cvss-v3-0-eg-1": "121", - "use-of-default-language-eg-1": "108", - "use-of-md5-as-the-only-hash-algorithm-eg-1": "101", - "use-of-non-self-referencing-urls-failing-to-resolve-eg-1": "125", - "use-of-private-language-eg-1": "107", - "use-of-self-referencing-urls-failing-to-resolve-eg-1": "126", - "use-of-sha-1-as-the-only-hash-algorithm-eg-1": "102", - "use-of-short-hash-eg-1": "124", - "version-range-in-product-version-eg-1": "91", + "unused-definition-of-product-id-eg-1": "98", + "usage-of-cwe-allowed-with-review-for-vulnerability-mapping-eg-1": "123", + "usage-of-cwe-not-allowed-for-vulnerability-mapping-eg-1": "122", + "usage-of-deprecated-cwe-eg-1": "120", + "usage-of-non-latest-cwe-version-eg-1": "121", + "usage-of-product-version-range-eg-1": "134", + "usage-of-v-as-version-indicator-eg-1": "135", + "use-of-cvss-v2-as-the-only-scoring-system-eg-1": "125", + "use-of-cvss-v3-0-eg-1": "126", + "use-of-default-language-eg-1": "112", + "use-of-md5-as-the-only-hash-algorithm-eg-1": "105", + "use-of-non-self-referencing-urls-failing-to-resolve-eg-1": "130", + "use-of-private-language-eg-1": "111", + "use-of-self-referencing-urls-failing-to-resolve-eg-1": "131", + "use-of-sha-1-as-the-only-hash-algorithm-eg-1": "106", + "use-of-short-hash-eg-1": "129", + "version-range-in-product-version-eg-1": "92", "version-type-eg-1": "23", "version-type-semantic-versioning-eg-1": "24", "version-type-semantic-versioning-eg-2": "25", "version-type-semantic-versioning-eg-3": "26", "version-type-semantic-versioning-eg-4": "27", "version-type-semantic-versioning-eg-5": "28", - "vex-product-status-eg-1": "83", - "vulnerabilities-for-informational-advisory-eg-1": "79", - "vulnerabilities-for-security-advisory-or-vex-eg-1": "87", - "vulnerabilities-property-cwes-eg-1": "43", - "vulnerabilities-property-cwes-eg-2": "44", - "vulnerabilities-property-cwes-eg-3": "45", - "vulnerabilities-property-ids-eg-1": "46", - "vulnerabilities-property-ids-eg-2": "47", - "vulnerability-id-eg-1": "84", - "vulnerability-notes-eg-1": "81" + "version-type-semantic-versioning-eg-6": "29", + "vex-product-status-eg-1": "84", + "vulnerabilities-for-informational-advisory-eg-1": "80", + "vulnerabilities-for-security-advisory-or-vex-eg-1": "88", + "vulnerabilities-property-cwes-eg-1": "44", + "vulnerabilities-property-cwes-eg-2": "45", + "vulnerabilities-property-cwes-eg-3": "46", + "vulnerabilities-property-ids-eg-1": "47", + "vulnerabilities-property-ids-eg-2": "48", + "vulnerability-id-eg-1": "85", + "vulnerability-notes-eg-1": "82" } \ No newline at end of file diff --git a/csaf_2.1/prose/edit/etc/section-display-to-label.json b/csaf_2.1/prose/edit/etc/section-display-to-label.json index 55ddfad9..e28c2a37 100644 --- a/csaf_2.1/prose/edit/etc/section-display-to-label.json +++ b/csaf_2.1/prose/edit/etc/section-display-to-label.json @@ -7,6 +7,7 @@ "1.5": "typographical-conventions", "2": "design-considerations", "2.1": "construction-principles", + "2.2": "date-and-time", "3": "schema-elements", "3.1": "definitions", "3.1.1": "acknowledgments-type", @@ -162,6 +163,9 @@ "6.1.31": "version-range-in-product-version", "6.1.32": "flag-without-product-reference", "6.1.33": "multiple-flags-with-vex-justification-codes-per-product", + "6.1.34": "mandatory-tests--branches-recursion-depth", + "6.1.35": "contradicting-remediations", + "6.1.36": "contradicting-product-status-remediation-combination", "6.2": "optional-tests", "6.2.1": "unused-definition-of-product-id", "6.2.2": "missing-remediation", @@ -189,6 +193,7 @@ "6.2.24": "usage-of-non-latest-cwe-version", "6.2.25": "usage-of-cwe-not-allowed-for-vulnerability-mapping", "6.2.26": "usage-of-cwe-allowed-with-review-for-vulnerability-mapping", + "6.2.27": "discouraged-product-status-remediation-combination", "6.3": "informative-test", "6.3.1": "use-of-cvss-v2-as-the-only-scoring-system", "6.3.2": "use-of-cvss-v3-0", @@ -261,6 +266,7 @@ "9.1.20": "conformance-clause-20-csaf-library-with-basic-validation", "9.1.21": "conformance-clause-21-csaf-library-with-extended-validation", "9.1.22": "conformance-clause-22-csaf-library-with-full-validation", + "9.1.23": "conformance-clause-23-csaf-downloader", "Appendix A.": "acknowledgments", "Appendix B.": "revision-history", "Appendix C.": "guidance-on-the-size-of-csaf-documents", diff --git a/csaf_2.1/prose/edit/etc/section-label-to-display.json b/csaf_2.1/prose/edit/etc/section-label-to-display.json index 9aed0ae6..6a6e3918 100644 --- a/csaf_2.1/prose/edit/etc/section-label-to-display.json +++ b/csaf_2.1/prose/edit/etc/section-label-to-display.json @@ -38,6 +38,7 @@ "conformance-clause-20-csaf-library-with-basic-validation": "9.1.20", "conformance-clause-21-csaf-library-with-extended-validation": "9.1.21", "conformance-clause-22-csaf-library-with-full-validation": "9.1.22", + "conformance-clause-23-csaf-downloader": "9.1.23", "conformance-clause-3-csaf-direct-producer": "9.1.3", "conformance-clause-4-csaf-converter": "9.1.4", "conformance-clause-5-cvrf-csaf-converter": "9.1.5", @@ -48,12 +49,16 @@ "conformance-targets": "9.1", "construction-principles": "2.1", "contradicting-product-status": "6.1.6", + "contradicting-product-status-remediation-combination": "6.1.36", + "contradicting-remediations": "6.1.35", "cve-in-field-ids": "6.2.17", "cvss-for-fixed-products": "6.2.19", "cwe": "6.1.11", "date": "C.6", + "date-and-time": "2.2", "definitions": "3.1", "design-considerations": "2", + "discouraged-product-status-remediation-combination": "6.2.27", "distributing-csaf-documents": "7", "document-notes": "6.1.27.1", "document-property": "3.2.2", @@ -117,6 +122,7 @@ "language-type": "3.1.4", "latest-document-version": "6.1.16", "mandatory-tests": "6.1", + "mandatory-tests--branches-recursion-depth": "6.1.34", "missing-canonical-url": "6.2.11", "missing-cve": "6.3.3", "missing-cvss-v4-0": "6.3.12", diff --git a/csaf_2.1/prose/edit/src/conformance.md b/csaf_2.1/prose/edit/src/conformance.md index 3a2aeb9a..426d009c 100644 --- a/csaf_2.1/prose/edit/src/conformance.md +++ b/csaf_2.1/prose/edit/src/conformance.md @@ -61,7 +61,7 @@ The entities ("conformance targets") for which this document defines requirement A text file or data stream satisfies the "CSAF document" conformance profile if it: -* conforms to the syntax and semantics defined in section [sec](#date-time) +* conforms to the syntax and semantics defined in section [sec](#date-and-time) * conforms to the syntax and semantics defined in section [sec](#schema-elements). * satisfies at least one profile defined in section [sec](#profiles). * does not fail any mandatory test defined in section [sec](#mandatory-tests). @@ -673,4 +673,5 @@ A program satisfies the "CSAF downloader" conformance profile if the program: * uses a program-specific HTTP User Agent, e.g. consisting of the name and version of the program. > A tool MAY implement an option to store CSAF documents that fail any of the steps in section [sec](#retrieving-csaf-documents). + ------- diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.html b/csaf_2.1/prose/share/csaf-v2.1-draft.html index 8e845916..c99352a0 100644 --- a/csaf_2.1/prose/share/csaf-v2.1-draft.html +++ b/csaf_2.1/prose/share/csaf-v2.1-draft.html @@ -41,8 +41,8 @@

Committee Specification Draft 01

-

- 28 August 2024 +

+ 30 October 2024

This stage: @@ -160,7 +160,7 @@

[csaf-v2.1]

- Common Security Advisory Framework Version 2.1. Edited by Stefan Hagen, and Thomas Schmidt. 28 August 2024. OASIS Committee Specification Draft 01. https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.html. Latest stage: Common Security Advisory Framework Version 2.1. Edited by Stefan Hagen, and Thomas Schmidt. 30 October 2024. OASIS Committee Specification Draft 01. https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html.

@@ -230,6 +230,8 @@

  • 3. Schema Elements @@ -586,6 +588,12 @@

  • 6.1.33 Multiple Flags with VEX Justification Codes per Product
    • +
  • 6.1.34 Branches Recursion Depth +
    • +
  • 6.1.35 Contradicting Remediations +
    • +
  • 6.1.36 Contradicting Product Status Remediation Combination +
  • 6.2 Optional Tests @@ -608,7 +616,7 @@

  • 6.2.9 Use of SHA-1 as the only Hash Algorithm
    • -
  • 6.2.10 Missing TLP label (deprecated) +
  • 6.2.10 Missing TLP label (obsolete)
  • 6.2.11 Missing Canonical URL
    • @@ -642,6 +650,8 @@

  • 6.2.26 Usage of CWE Allowed with Review for Vulnerability Mapping
    • +
  • 6.2.27 Discouraged Product Status Remediation Combination +
  • 6.3 Informative Test @@ -802,6 +812,8 @@

  • 9.1.22 Conformance Clause 22: CSAF library with full validation
    • +
  • 9.1.23 Conformance Clause 23: CSAF downloader +
    • @@ -930,6 +942,12 @@

    security advisory text document in the format defined by this document.
    +
    + CSAF downloader +
    +
    + A program that retrieves CSAF documents in an automated fashion. +
    CSAF extended validator
    @@ -1092,6 +1110,12 @@

    result which an end user decides does not actually represent a problem
    +
    + filter +
    +
    + refine a list by selecting entries that match given criteria +
    fingerprint
    @@ -1230,6 +1254,12 @@

    container for a related set of files in a version control system
    +
    + search +
    +
    + compile a list of entries that match given criteria +
    taxonomy
    @@ -1324,6 +1354,10 @@

    1.3 Normative References

    +

    + [ISO8601] Data elements and interchange formats — Information interchange — Representation of dates and times, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html. +

    [JSON-Schema-Core] JSON Schema: A Media Type for Describing JSON Documents, draft-bhutton-json-schema-00, December 2020, https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00. @@ -1343,6 +1377,9 @@

    [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.

    +

    + [RFC3339] Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, https://www.rfc-editor.org/info/rfc3339. +

    [RFC7464] Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, https://www.rfc-editor.org/info/rfc7464.

    @@ -1416,10 +1453,6 @@

    [GFMENG] GitHub Engineering: A formal spec for GitHub Flavored Markdown, https://githubengineering.com/a-formal-spec-for-github-markdown/.

    -

    - [ISO8601] Data elements and interchange formats — Information interchange — Representation of dates and times, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html. -

    [ISO19770-2] Information technology — IT asset management — Part 2: Software identification tag, International Standard, ISO 19770-2:2015, September 30, 2015, https://www.iso.org/standard/65666.html. @@ -1433,9 +1466,6 @@

    [PURL] Package URL (purl), GitHub Project, https://github.com/package-url/purl-spec.

    -

    - [RFC3339] Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, https://www.rfc-editor.org/info/rfc3339. -

    [RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, https://www.rfc-editor.org/info/rfc3552.

    @@ -1652,6 +1682,26 @@

    from the specification which can not be tested by the schema. Section 7 states how to distribute and where to find CSAF documents. Safety, Security and Data Protection are considered in section 8. Finally, a set of conformance targets describes tools in the ecosystem.

    +

    + 2.2 Date and Time +

    +

    + This standard uses the date-time format as defined in JSON Schema Draft 2020-12 Section 7.3.1. In accordance with RFC 3339 and ISO 8601, the following rules apply: +

    +

    3. Schema Elements @@ -2113,29 +2163,28 @@

    "cpe": { // ... }, - "hashes": [ + "hashes": { // ... - ], - "model_numbers": [ + }, + "model_numbers": { // ... - ], + }, "purl": { // ... }, - "sbom_urls": [ + "sbom_urls": { // ... - ], - "serial_numbers": [ + }, + "serial_numbers": { // ... - ], - "skus": [ + }, + "skus": { // ... - ], - "x_generic_uris": [ + }, + "x_generic_uris": { // ... - ] - } - } + } + }

    3.1.3.3.1 Full Product Name Type - Product Identification Helper - CPE
    @@ -2146,6 +2195,11 @@

    The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification. See [CPE23-N] for details.

    +
    +

    + Both, CPE 2.2 and CPE 2.3, are supported in CSAF. +

    +
    3.1.3.3.2 Full Product Name Type - Product Identification Helper - Hashes
    @@ -2800,7 +2854,7 @@ 

    1.0.0-0.3.7
 1.0.0-alpha
 1.0.0-alpha.1
-1.0.0-x-y-z.–
+1.0.0-x-y-z.--
 1.0.0-x.7.z.92
  • @@ -2817,7 +2871,7 @@

    Examples 2: 

    1.0.0+20130313144700
-1.0.0+21AF26D3—-117B344092BD
+1.0.0+21AF26D3----117B344092BD
 1.0.0-alpha+001
 1.0.0-beta+exp.sha.5114f85

    • @@ -2871,6 +2925,17 @@

    +

    + Note, that the following values do no conform the semantic versioning described above. +

    +

    + Examples 6 (which are invalid): +

    + 
      1.16.13.14-Cor
+  1.0.0-x-y-z.–
+  1.0.0+21AF26D3—-117B344092BD
+  2.5.20+3f93da6b+7cc
+  3.20.0-00

    3.2 Properties

    @@ -2972,7 +3037,7 @@

    The Text of aggregate severity (text) of value type string with 1 or more characters provides a severity which is independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).

    - Examples 1: + Examples 1: 

        Critical
     Important
@@ -2996,7 +3061,7 @@ 
    
       // ...
     }

    - Examples 1: + Examples 1: 

        csaf_base
     csaf_security_advisory
@@ -3036,7 +3101,7 @@ 
    
       The Textual description (text) of value type string with 1 or more characters provides a textual description of additional constraints.
     
    
     
    
-      Examples 1:
+      Examples 1:
     
    
     
        Copyright 2024, Example Company, All Rights Reserved.
     Distribute freely.
@@ -3084,7 +3149,7 @@ 
    
     
    
     
        https://www.first.org/tlp/
    
     
    
-      Examples 1:
+      Examples 1:
     
    
     
        https://www.us-cert.gov/tlp
     https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/TLP/merkblatt-tlp.pdf
    
@@ -3232,7 +3297,7 @@ 
    
       Contact details (contact_details) of value type string with 1 or more characters provides information on how to contact the publisher, possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
     
    
     
    
-      Example 1:
+      Example 1:
     
    
     
        Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
    
     
    
@@ -3248,7 +3313,7 @@ 
    
       The Name of publisher (name) of value type string with 1 or more characters contains the name of the issuing party.
     
    
     
    
-      Example 1:
+      Example 1:
     
    
     
         BSI
      Cisco PSIRT
@@ -3277,7 +3342,7 @@ 
    
       
     
     
    
-      Examples 1:
+      Examples 1:
     
    
     
        https://csaf.io
     https://www.example.com
    
@@ -3312,7 +3377,7 @@ 
    
       Title of this document (title) of value type string with 1 or more characters SHOULD be a canonical name for the document, and sufficiently unique to distinguish it from similar documents.
     
    
     
    
-      Examples 1:
+      Examples 1:
     
    
     
        Cisco IPv6 Crafted Packet Denial of Service Vulnerability
     Example Company Cross-Site-Scripting Vulnerability in Example Generator
    
@@ -3368,7 +3433,7 @@ 
    
       Every such Alternate Name of value type string with 1 or more characters specifies a non-empty string that represents a distinct optional alternative ID used to refer to the document.
     
    
     
    
-      Example 1:
+      Example 1:
     
    
     
        CVE-2019-12345
    
     
    
@@ -3417,7 +3482,7 @@ 
    
       Engine name (name) of value type string with 1 or more characters represents the name of the engine that generated the CSAF document.
     
    
     
    
-      Examples 1:
+      Examples 1:
     
    
     
        Red Hat rhsa-to-cvrf
     Secvisogram
@@ -3431,7 +3496,7 @@ 
    
       
    
     
     
    
-      Examples 2:
+      Examples 2:
     
    
     
        0.6.0
     1.0.0-beta+exp.sha.a1c44f85
@@ -3455,7 +3520,7 @@ 
    
       The ID is a simple label that provides for a wide range of numbering values, types, and schemes. Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
     
    
     
    
-      Examples 1:
+      Examples 1:
     
    
     
        Example Company - 2019-YH3234
     RHBA-2019:0024
@@ -3620,7 +3685,7 @@ 
    
       The summary of the product group (summary) of value type string with 1 or more characters gives a short, optional description of the group.
     
    
     
    
-      Examples 1:
+      Examples 1:
     
    
     
        Products supporting Modbus.
     The x64 versions of the operating system.
    
@@ -3698,7 +3763,7 @@ 
    
       Relates to Product Reference (relates_to_product_reference) of value type Product ID (product_id_t) holds a Product ID that refers to the Full Product Name element, which is referenced as the second element of the relationship.
     
    
     
    
-      Examples 1:
+      Examples 1:
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -3851,7 +3916,7 @@ 
    
       It holds the ID for the weakness associated.
     
    
     
    
-      Examples 1:
+      Examples 1:
     
    
     
        CWE-22
     CWE-352
@@ -3860,7 +3925,7 @@ 
    
       The Weakness name (name) has value type string with 1 or more characters and holds the full name of the weakness as given in the CWE specification.
     
    
     
    
-      Examples 2:
+      Examples 2:
     
    
     
        Cross-Site Request Forgery (CSRF)
     Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
@@ -3873,7 +3938,7 @@ 
    
       It holds the version string of the CWE specification this weakness was extracted from. When creating or modifying a CSAF document, the latest published version of the CWE specification SHOULD be used.
     
    
     
    
-      Examples 3:
+      Examples 3:
     
    
     
        "1.0",
     "3.4.1",
@@ -3998,7 +4063,7 @@ 
    
       System name (system_name) of value type string with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
     
    
     
    
-      Examples 1:
+      Examples 1:
     
    
     
        Cisco Bug ID
     GitHub Issue
    
@@ -4006,7 +4071,7 @@ 
    
       Text (text) of value type string with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
     
    
     
    
-      Examples 2:
+      Examples 2:
     
    
     
        CSCso66472
     oasis-tcs/csaf#210
    
@@ -4386,9 +4451,11 @@ 
    
     
    
       Category of the remediation (category) of value type string and enum specifies the category which this remediation belongs to. Valid values are:
     
    
-    
        mitigation
+    
        fix_planned
+    mitigation
     no_fix_planned
     none_available
+    optional_patch
     vendor_fix
     workaround
    
     
    
@@ -4400,21 +4467,416 @@ 
    
       product. Mitigations MAY or MAY NOT be issued by the original author of the affected product, and they MAY or MAY NOT be officially sanctioned by the document producer.
     
    
     
    
-      The value vendor_fix indicates that the remediation contains information about an official fix that is issued by the original author of the affected product. Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability. This value contradicts with the categories none_available and
-      no_fix_planned for the same product. Therefore, such a combination can't be used in the list of remediations.
+      The value vendor_fix indicates that the remediation contains information about an official fix that is issued by the original author of the affected product. Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
     
    
     
    
-      The value none_available indicates that there is currently no fix or other remediation available. The text in field details SHOULD contain details about why there is no fix or other remediation. The values none_available and vendor_fix are mutually exclusive per product.
+      The value optional_patch indicates that the remediation contains information about an patch that is issued by the original author of the affected product. Its application is not necessary, but might be desired by the user, e.g. to calm a security scanner by updating a dependency to a fixed version even though the dependency
+      in the affected version was used in the product in a way that the product itself was not affected. Unless otherwise noted, it is assumed that this does not change the state regarding the vulnerability.
     
    
     
    
       
    
-        An issuing party might choose to use this category to announce that a fix is currently developed. It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.
+        This is sometimes also referred to as a "regulatory compliance patch".
       
    
     
    
+    
    
+      The value none_available indicates that there is currently no fix or other remediation available. The text in field details SHOULD contain details about why there is no fix or other remediation.
+    
    
+    
    
+      The value fix_planned indicates that there is a fix for the vulnerability planned but not yet ready. An issuing party might choose to use this category to announce that a fix is currently developed. The text in field details SHOULD contain details including a date when a customer can expect the fix to be ready
+      and distributed.
+    
    
     
    
       The value no_fix_planned indicates that there is no fix for the vulnerability and it is not planned to provide one at any time. This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated. The text in field details SHOULD contain details about why there will be no fix
-      issued. The values no_fix_planned and vendor_fix are mutually exclusive per product.
+      issued.
+    
    
+    
    
+      Some category values contradict each other and thus are mutually exclusive per product. Therefore, such a combination MUST NOT be used in the list of remediations for the same product. This is independent from whether the product is referenced directly or indirectly through a product group. The following tables shows the allowed and
+      prohibited combinations:
     
    
+    
+      
+        
+          
+          
+          
+          
+          
+          
+          
+          
+        
+      
+      
+        
+          
+          
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+          
+          
+        
+      
+    
    
+            category value
+          
+            workaround
+          
+            mitigation
+          
+            vendor_fix
+          
+            optional_patch
+          
+            none_available
+          
+            fix_planned
+          
+            no_fix_planned
+          
    
+            workaround
+          
+            allowed
+          
+            allowed
+          
+            allowed
+          
+            prohibited
+          
+            prohibited
+          
+            allowed
+          
+            allowed
+          
    
+            mitigation
+          
+            allowed
+          
+            allowed
+          
+            allowed
+          
+            prohibited
+          
+            prohibited
+          
+            allowed
+          
+            allowed
+          
    
+            vendor_fix
+          
+            allowed
+          
+            allowed
+          
+            allowed
+          
+            prohibited
+          
+            prohibited
+          
+            prohibited
+          
+            prohibited
+          
    
+            optional_patch
+          
+            prohibited
+          
+            prohibited
+          
+            prohibited
+          
+            allowed
+          
+            prohibited
+          
+            prohibited
+          
+            prohibited
+          
    
+            none_available
+          
+            prohibited
+          
+            prohibited
+          
+            prohibited
+          
+            prohibited
+          
+            allowed
+          
+            prohibited
+          
+            prohibited
+          
    
+            fix_planned
+          
+            allowed
+          
+            allowed
+          
+            prohibited
+          
+            prohibited
+          
+            prohibited
+          
+            allowed
+          
+            prohibited
+          
    
+            no_fix_planned
+          
+            allowed
+          
+            allowed
+          
+            prohibited
+          
+            prohibited
+          
+            prohibited
+          
+            prohibited
+          
+            allowed
+          
    
+    
    
+      Some category values contradict certain product status groups. Therefore, such a combination MUST NOT exist in a vulnerability item for the same product. This is independent from whether the product is referenced directly or indirectly through a product group. The following tables shows the allowed, discouraged and prohibited
+      combinations:
+    
    
+    
+      
+        
+          
+          
+          
+          
+          
+          
+        
+      
+      
+        
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+        
+        
+          
+          
+          
+          
+          
+          
+        
+      
+    
    
+            category value
+          
+            Affected
+          
+            Not Affected
+          
+            Fixed
+          
+            Under Investigation
+          
+            Recommended
+          
    
+            workaround
+          
+            allowed
+          
+            prohibited
+          
+            prohibited
+          
+            discouraged
+          
+            allowed
+          
    
+            mitigation
+          
+            allowed
+          
+            prohibited
+          
+            prohibited
+          
+            discouraged
+          
+            allowed
+          
    
+            vendor_fix
+          
+            allowed
+          
+            prohibited
+          
+            prohibited
+          
+            discouraged
+          
+            allowed
+          
    
+            optional_patch
+          
+            prohibited
+          
+            allowed
+          
+            discouraged
+          
+            allowed
+          
+            allowed
+          
    
+            none_available
+          
+            allowed
+          
+            prohibited
+          
+            prohibited
+          
+            allowed
+          
+            allowed
+          
    
+            fix_planned
+          
+            allowed
+          
+            discouraged
+          
+            prohibited
+          
+            discouraged
+          
+            allowed
+          
    
+            no_fix_planned
+          
+            allowed
+          
+            discouraged
+          
+            prohibited
+          
+            allowed
+          
+            allowed
+          
    
     
    
       3.2.4.13.2 Vulnerabilities Property - Remediations - Date 
     
    
@@ -4941,7 +5403,7 @@ 
    
       
     
     
    
-      Examples 1:
+      Examples 1:
     
    
     
      cisco-sa-20190513-secureboot.json
   example_company_-_2019-yh3234.json
@@ -4952,7 +5414,7 @@ 
    
       
    
     
     
    
-      Examples 2:
+      Examples 2:
     
    
     
      cisco-sa-20190513-secureboot_invalid.json
   example_company_-_2019-yh3234_invalid.json
@@ -5038,7 +5500,7 @@ 
    
   /vulnerabilities[]/remediations[]/product_ids[]
   /vulnerabilities[]/threats[]/product_ids[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "product_groups": [
@@ -5069,7 +5531,7 @@ 
    
   /product_tree/full_product_names[]/product_id
   /product_tree/relationships[]/full_product_name/product_id
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -5105,7 +5567,7 @@ 
    
       
    
     
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -5144,7 +5606,7 @@ 
    
     
      /vulnerabilities[]/remediations[]/group_ids
   /vulnerabilities[]/threats[]/group_ids
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -5183,7 +5645,7 @@ 
    
     
    
     
        /product_tree/product_groups[]/group_id
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -5266,7 +5728,7 @@ 
    
       
    
     
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -5309,7 +5771,7 @@ 
    
     
    
     
        /vulnerabilities[]/metrics[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -5369,7 +5831,7 @@ 
    
   /vulnerabilities[]/metrics[]/content/cvss_v3
   /vulnerabilities[]/metrics[]/content/cvss_v4
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "cvss_v3": {
     "version": "3.1",
@@ -5416,7 +5878,7 @@ 
    
   /vulnerabilities[]/metrics[]/content/cvss_v4/environmentalScore
   /vulnerabilities[]/metrics[]/content/cvss_v4/environmentalSeverity
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "cvss_v3": {
     "version": "3.1",
@@ -5447,7 +5909,7 @@ 
    
   /vulnerabilities[]/metrics[]/content/cvss_v3
   /vulnerabilities[]/metrics[]/content/cvss_v4
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "cvss_v3": {
     "version": "3.1",
@@ -5484,7 +5946,7 @@ 
    
     
    
     
        /vulnerabilities[]/cwes[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "cwes": [
     {
@@ -5510,7 +5972,7 @@ 
    
     
      /document/lang
   /document/source_lang
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "lang": "EZ"
    
     
    
@@ -5536,7 +5998,7 @@ 
    
   /product_tree/full_product_names[]/product_identification_helper/purl
   /product_tree/relationships[]/full_product_name/product_identification_helper/purl
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -5565,7 +6027,7 @@ 
    
     
    
     
        /document/tracking/revision_history
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "revision_history": [
     {
@@ -5595,7 +6057,7 @@ 
    
     
    
     
        /document/source_lang
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "document": {
     // ...
@@ -5624,7 +6086,7 @@ 
    
     
    
     
        /document/tracking/version
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "tracking": {
     // ...
@@ -5659,7 +6121,7 @@ 
    
     
    
     
        /document/tracking/status
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "tracking": {
       // ...
@@ -5682,7 +6144,7 @@ 
    
     
    
     
        /document/tracking/revision_history[]/number
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "tracking": {
       // ...
@@ -5717,7 +6179,7 @@ 
    
     
    
     
        /document/tracking/revision_history[]/number
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "revision_history": [
       {
@@ -5747,7 +6209,7 @@ 
    
     
    
     
        /document/tracking/version
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "tracking": {
       // ...
@@ -5771,7 +6233,7 @@ 
    
     
    
     
        /document/tracking/revision_history
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "revision_history": [
       {
@@ -5801,7 +6263,7 @@ 
    
     
    
     
        /document/tracking/revision_history
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
       "revision_history": [
       {
@@ -5831,7 +6293,7 @@ 
    
     
    
     
        /vulnerabilities[]/cve
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "vulnerabilities": [
     {
@@ -5857,7 +6319,7 @@ 
    
     
    
     
        /vulnerabilities[]/involvements
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "vulnerabilities": [
     {
@@ -5894,7 +6356,7 @@ 
    
   /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -5954,7 +6416,7 @@ 
    
     
    
     
      /document/category
    
     
    
-      Examples 1 (for currently prohibited values):
+      Examples 1 (for currently prohibited values):
     
    
     
      Csaf_a
   Informational Advisory
@@ -5963,7 +6425,7 @@ 
    
   veX
   V_eX
    
     
    
-      Example 2 (which fails the test):
+      Example 2 (which fails the test):
     
    
     
      "category": "Security_Incident_Response"
    
     
    
@@ -5998,7 +6460,7 @@ 
    
     
    
     
      /document/notes
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "notes": [
     {
@@ -6028,7 +6490,7 @@ 
    
     
    
     
      /document/references
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "references": [
     {
@@ -6057,7 +6519,7 @@ 
    
     
    
     
      /vulnerabilities
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "vulnerabilities": [
     {
@@ -6090,7 +6552,7 @@ 
    
     
    
     
      /product_tree
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      {
     "document": {
@@ -6121,7 +6583,7 @@ 
    
     
    
     
      /vulnerabilities[]/notes
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "vulnerabilities": [
     {
@@ -6148,7 +6610,7 @@ 
    
     
    
     
      /vulnerabilities[]/product_status
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "vulnerabilities": [
     {
@@ -6178,7 +6640,7 @@ 
    
   /vulnerabilities[]/product_status/known_not_affected
   /vulnerabilities[]/product_status/under_investigation
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_status": {
     "first_fixed": [
@@ -6209,7 +6671,7 @@ 
    
     
      /vulnerabilities[]/cve
   /vulnerabilities[]/ids
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "vulnerabilities": [
     {
@@ -6237,7 +6699,7 @@ 
    
     
      /vulnerabilities[]/flags
   /vulnerabilities[]/threats
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -6308,7 +6770,7 @@ 
    
     
    
     
      /vulnerabilities[]/remediations
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -6381,7 +6843,7 @@ 
    
     
    
     
      /vulnerabilities
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      {
     "document": {
@@ -6408,7 +6870,7 @@ 
    
     
      /document/lang
   /document/source_lang
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "document": {
     // ...
@@ -6441,7 +6903,7 @@ 
    
     
    
     
      /vulnerabilities[]/remediations[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
          "remediations": [
         {
@@ -6471,7 +6933,7 @@ 
    
     
      /document/tracking/revision_history[]/number
   /document/tracking/version
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "tracking": {
       // ...
@@ -6527,7 +6989,7 @@ 
    
     
    
     
      /product_tree/branches[](/branches[])*/name
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
                "branches": [
               {
@@ -6552,7 +7014,7 @@ 
    
     
    
     
      /vulnerabilities[]/flags[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
          "flags": [
         {
@@ -6580,7 +7042,7 @@ 
    
     
    
     
      /vulnerabilities[]/flags
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -6634,6 +7096,288 @@ 
    
         There are two flags given for CSAFPID-9080700 - one indirect through CSAFGID-0001 and one direct.
       
    
     
    
+    
    
+      6.1.34 Branches Recursion Depth 
+    
    
+    
    
+      For each product defined under /product_tree/branches[] it MUST be tested that the complete JSON path does not contain more than 30 instances of branches.
+    
    
+    
    
+      The relevant path for this test is:
+    
    
+    
      /product_tree/branches[](/branches[])*/product
    
+    
    
+      Example 1 (which fails the test):
+    
    
+    
      "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "branches": [
+                  {
+                    "branches": [
+                      {
+                        "branches": [
+                          {
+                            "branches": [
+                              {
+                                "branches": [
+                                  {
+                                    "branches": [
+                                      {
+                                        "branches": [
+                                          {
+                                            "branches": [
+                                              {
+                                                "branches": [
+                                                  {
+                                                    "branches": [
+                                                      {
+                                                        "branches": [
+                                                          {
+                                                            "branches": [
+                                                              {
+                                                                "branches": [
+                                                                  {
+                                                                    "branches": [
+                                                                      {
+                                                                        "branches": [
+                                                                          {
+                                                                            "branches": [
+                                                                              {
+                                                                                "branches": [
+                                                                                  {
+                                                                                    "branches": [
+                                                                                      {
+                                                                                        "branches": [
+                                                                                          {
+                                                                                            "branches": [
+                                                                                              {
+                                                                                                "branches": [
+                                                                                                  {
+                                                                                                    "branches": [
+                                                                                                      {
+                                                                                                        "branches": [
+                                                                                                          {
+                                                                                                            "branches": [
+                                                                                                              {
+                                                                                                                "branches": [
+                                                                                                                  {
+                                                                                                                    "branches": [
+                                                                                                                      {
+                                                                                                                        "branches": [
+                                                                                                                          {
+                                                                                                                            "branches": [
+                                                                                                                              {
+                                                                                                                                "category": "product_name",
+                                                                                                                                "name": "branches",
+                                                                                                                                "product": {
+                                                                                                                                  "name": "<<generate Product name>>",
+                                                                                                                                  "product_id": "CSAFPID-9080700"
+                                                                                                                                }
+                                                                                                                              }
+                                                                                                                            ],
+                                                                                                                            "category": "product_family",
+                                                                                                                            "name": "31"
+                                                                                                                          }
+                                                                                                                        ],
+                                                                                                                        "category": "product_family",
+                                                                                                                        "name": "with"
+                                                                                                                      }
+                                                                                                                    ],
+                                                                                                                    "category": "product_family",
+                                                                                                                    "name": "test"
+                                                                                                                  }
+                                                                                                                ],
+                                                                                                                "category": "product_family",
+                                                                                                                "name": "the"
+                                                                                                              }
+                                                                                                            ],
+                                                                                                            "category": "product_family",
+                                                                                                            "name": "fail"
+                                                                                                          }
+                                                                                                        ],
+                                                                                                        "category": "product_family",
+                                                                                                        "name": "and"
+                                                                                                      }
+                                                                                                    ],
+                                                                                                    "category": "product_family",
+                                                                                                    "name": "limits"
+                                                                                                  }
+                                                                                                ],
+                                                                                                "category": "product_family",
+                                                                                                "name": "the"
+                                                                                              }
+                                                                                            ],
+                                                                                            "category": "product_family",
+                                                                                            "name": "testing"
+                                                                                          }
+                                                                                        ],
+                                                                                        "category": "product_family",
+                                                                                        "name": "are"
+                                                                                      }
+                                                                                    ],
+                                                                                    "category": "product_family",
+                                                                                    "name": "they"
+                                                                                  }
+                                                                                ],
+                                                                                "category": "product_family",
+                                                                                "name": "but"
+                                                                              }
+                                                                            ],
+                                                                            "category": "product_family",
+                                                                            "name": "unrealistic"
+                                                                          }
+                                                                        ],
+                                                                        "category": "product_family",
+                                                                        "name": "less"
+                                                                      }
+                                                                    ],
+                                                                    "category": "product_family",
+                                                                    "name": "or"
+                                                                  }
+                                                                ],
+                                                                "category": "product_family",
+                                                                "name": "more"
+                                                              }
+                                                            ],
+                                                            "category": "product_family",
+                                                            "name": "and"
+                                                          }
+                                                        ],
+                                                        "category": "product_family",
+                                                        "name": "unnecessary"
+                                                      }
+                                                    ],
+                                                    "category": "product_family",
+                                                    "name": "seem"
+                                                  }
+                                                ],
+                                                "category": "product_family",
+                                                "name": "which"
+                                              }
+                                            ],
+                                            "category": "product_family",
+                                            "name": "product"
+                                          }
+                                        ],
+                                        "category": "product_family",
+                                        "name": "hypothetical"
+                                      }
+                                    ],
+                                    "category": "product_family",
+                                    "name": "this"
+                                  }
+                                ],
+                                "category": "product_family",
+                                "name": "for"
+                              }
+                            ],
+                            "category": "product_family",
+                            "name": "structure"
+                          }
+                        ],
+                        "category": "product_family",
+                        "name": "nested"
+                      }
+                    ],
+                    "category": "product_family",
+                    "name": "deeply"
+                  }
+                ],
+                "category": "product_family",
+                "name": "a"
+              }
+            ],
+            "category": "product_family",
+            "name": "uses"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  }
    
+    
    
+      
    
+        The complete JSON path contains 31 times branches.
+      
    
+    
    
+    
    
+      6.1.35 Contradicting Remediations 
+    
    
+    
    
+      For each item in /vulnerabilities[]/remediations it MUST be tested that a product is not member of contradicting remediation categories. This takes indirect relations through product groups into account.
+    
    
+    
    
+      The relevant path for this test is:
+    
    
+    
      /vulnerabilities[]/remediations[]
    
+    
    
+      Example 1 (which fails the test):
+    
    
+    
          "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "The product is end-of-life. Therefore, no fix will be provided.",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        },
+        {
+          "category": "vendor_fix",
+          "details": "Update to version >=14.3 to fix the vulnerability.",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
    
+    
    
+      
    
+        The two remediations given for the product with product ID CSAFPID-908070 contradict each other.
+      
    
+    
    
+    
    
+      
    
+        A tool MAY apply the conversion rules from the conformance target CSAF 2.0 to CSAF 2.1 converter if applicable or remove the product from the remediation with the lower priority. The priority MAY be defined as follows: vendor_fix > mitigation > workaround > fix_planned >
+        no_fix_planned > optional_patch > none_available
+      
    
+    
    
+    
    
+      6.1.36 Contradicting Product Status Remediation Combination 
+    
    
+    
    
+      For each item in /vulnerabilities[]/remediations it MUST be tested that a product is not member of a contradicting product status group. This takes indirect relations through product groups into account.
+    
    
+    
    
+      The relevant path for this test is:
+    
    
+    
      /vulnerabilities[]/remediations[]
    
+    
    
+      Example 1 (which fails the test):
+    
    
+    
          "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "Update to version >=14.3 to fix the vulnerability.",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
    
+    
    
+      
    
+        For the product with product ID CSAFPID-908070 a vendor_fix is given but the product was not affected at all.
+      
    
+    
    
     
    
       6.2 Optional Tests 
     
    
@@ -6656,7 +7400,7 @@ 
    
   /product_tree/full_product_names[]/product_id
   /product_tree/relationships[]/full_product_name/product_id
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -6695,7 +7439,7 @@ 
    
   /vulnerabilities[]/product_status/last_affected[]
   /vulnerabilities[]/product_status/under_investigation[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -6732,7 +7476,7 @@ 
    
   /vulnerabilities[]/product_status/known_affected[]
   /vulnerabilities[]/product_status/last_affected[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -6767,7 +7511,7 @@ 
    
     
    
     
        /document/tracking/revision_history[]/number
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "revision_history": [
       {
@@ -6792,7 +7536,7 @@ 
    
     
    
     
        /document/tracking/initial_release_date
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "tracking": {
       // ...
@@ -6827,7 +7571,7 @@ 
    
     
    
     
        /document/tracking/current_release_date
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "tracking": {
       "current_release_date": "2023-09-06T10:00:00.000Z",
@@ -6862,7 +7606,7 @@ 
    
     
    
     
        /vulnerabilities[]/involvements
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "vulnerabilities": [
     {
@@ -6897,7 +7641,7 @@ 
    
   /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -6943,7 +7687,7 @@ 
    
   /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -6971,30 +7715,12 @@ 
    
         The hash algorithm sha1 is used in one item of hashes without being accompanied by a second hash algorithm.
       
    
     
-    
    
-      6.2.10 Missing TLP label (deprecated) 
+    
    
+      6.2.10 Missing TLP label (obsolete) 
     
    
-    
    
-      It MUST be tested that /document/distribution/tlp/label is present and valid.
-    
    
-    
    
-      
    
-        TLP labels support the machine-readability and automated distribution.
-      
    
-    
    
-    
    
-      The relevant path for this test is:
-    
    
-    
      /document/distribution/tlp/label
    
-    
    
-      Example 1 (which fails the test):
-    
    
-    
        "distribution": {
-      "text": "Distribute freely."
-    }
    
     
    
       
    
-        The CSAF document has no TLP label.
+        The TLP label is now required by the schema. Therefore, the optional test is obsolete. This section is kept to document that change and keep the numbering of the remaining sections stable.
       
    
     
    
     
    
@@ -7021,7 +7747,7 @@ 
    
     
    
     
      /document/references
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "document": {
     // ...
@@ -7057,7 +7783,7 @@ 
    
     
    
     
      /document/lang
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "document": {
     "category": "csaf_base",
@@ -7088,7 +7814,7 @@ 
    
     
    
     
      /
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "document": {
     "csaf_version": "2.1",
@@ -7117,7 +7843,7 @@ 
    
     
      /document/lang
   /document/source_lang
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "lang": "qtx"
    
     
    
@@ -7142,7 +7868,7 @@ 
    
     
      /document/lang
   /document/source_lang
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "lang": "i-default"
    
     
    
@@ -7168,7 +7894,7 @@ 
    
   /product_tree/full_product_names[]
   /product_tree/relationships[]/full_product_name
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "full_product_names": [
       {
@@ -7197,7 +7923,7 @@ 
    
     
    
     
      /vulnerabilities[]/ids[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
          "ids": [
         {
@@ -7232,7 +7958,7 @@ 
    
     
    
     
      /product_tree/branches[](/branches[])*/name
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
                "branches": [
               {
@@ -7259,7 +7985,7 @@ 
    
     
      /vulnerabilities[]/product_status/first_fixed[]
   /vulnerabilities[]/product_status/fixed[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -7319,7 +8045,7 @@ 
    
       
    
     
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "document": {
     "category": "csaf_base",
@@ -7348,7 +8074,7 @@ 
    
     
    
     
      /document/tracking/revision_history[]/date
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "revision_history": [
     {
@@ -7378,7 +8104,7 @@ 
    
     
    
     
      /document/title
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "title": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-22-01: Optional test: Document Tracking ID in Title (failing example 1)",
     "tracking": {
@@ -7407,7 +8133,7 @@ 
    
     
    
     
      /vulnerabilities[]/cwes[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
         "cwes": [
         {
@@ -7437,7 +8163,7 @@ 
    
     
    
     
      /vulnerabilities[]/cwes[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "document": {
     // ...
@@ -7483,7 +8209,7 @@ 
    
     
    
     
      /vulnerabilities[]/cwes[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
          "cwes": [
         {
@@ -7513,7 +8239,7 @@ 
    
     
    
     
      /vulnerabilities[]/cwes[]
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
          "cwes": [
         {
@@ -7527,6 +8253,38 @@ 
    
         The usage of CWE-1023 is allowed with review as the "CWE entry is a Class and might have Base-level children that would be more appropriate". cite
       
    
     
+    
    
+      6.2.27 Discouraged Product Status Remediation Combination 
+    
    
+    
    
+      For each item in /vulnerabilities[]/remediations it MUST be tested that a Product is not member of a discouraged product status group remediation category combination. This takes indirect relations through Product Groups into account.
+    
    
+    
    
+      The relevant path for this test is:
+    
    
+    
      /vulnerabilities[]/remediations[]
    
+    
    
+      Example 1 (which fails the test):
+    
    
+    
          "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "fix_planned",
+          "details": "The fix should be available in Q4 2024.",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
    
+    
    
+      
    
+        For the product with product ID CSAFPID-908070 a fix is planned but the product was not affected at all.
+      
    
+    
    
     
    
       6.3 Informative Test 
     
    
@@ -7550,7 +8308,7 @@ 
    
     
    
     
        /vulnerabilities[]/metrics
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -7601,7 +8359,7 @@ 
    
     
      /vulnerabilities[]/metrics[]/content/cvss_v3/version
   /vulnerabilities[]/metrics[]/content/cvss_v3/vectorString
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "cvss_v3": {
     "version": "3.0",
@@ -7637,7 +8395,7 @@ 
    
     
    
     
      /vulnerabilities[]/cve
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "vulnerabilities": [
     {
@@ -7666,7 +8424,7 @@ 
    
     
    
     
      /vulnerabilities[]/cwe
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "vulnerabilities": [
     {
@@ -7692,7 +8450,7 @@ 
    
   /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -7755,7 +8513,7 @@ 
    
   /vulnerabilities[]/references[]/url
   /vulnerabilities[]/remediations[]/url
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "references": [
       {
@@ -7785,7 +8543,7 @@ 
    
     
      /document/references[]/url
   /vulnerabilities[]/references[]/url
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "references": [
       {
@@ -7846,7 +8604,7 @@ 
    
   /vulnerabilities[]/threats[]/details
   /vulnerabilities[]/title
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "document": {
     // ...
@@ -7881,7 +8639,7 @@ 
    
     
    
     
      /product_tree/branches
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
        "branches": [
       {
@@ -7926,7 +8684,7 @@ 
    
     
    
     
      /product_tree/branches[](/branches[])*/category
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
                    "category": "product_version_range",
    
     
    
@@ -7951,7 +8709,7 @@ 
    
     
    
     
      /product_tree/branches[](/branches[])*/name
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
                "branches": [
               {
@@ -7976,7 +8734,7 @@ 
    
     
    
     
        /vulnerabilities[]/metrics[]/content
    
     
    
-      Example 1 (which fails the test):
+      Example 1 (which fails the test):
     
    
     
      "product_tree": {
     "full_product_names": [
@@ -8075,6 +8833,9 @@ 
    
         Reasoning: Clients should not parse the payload for navigation and some, as e.g. curl, do not follow any other kind of redirects.
       
    
     
    
+    
    
+      If any redirects are used, there SHOULD not be more than 5 and MUST NOT be more than 10 consecutive redirects.
+    
    
     
    
       7.1.7 Requirement 7: provider-metadata.json 
     
    
@@ -8107,7 +8868,7 @@ 
    
       
     
     
    
-      Example 1 (minimal with ROLIE document):
+      Example 1 (minimal with ROLIE document):
     
    
     
      {
     "canonical_url": "https://www.example.com/.well-known/csaf/provider-metadata.json",
@@ -8161,11 +8922,11 @@ 
    
     
    
     
    
       
    
-        The security.txt was published as [RFC9116] in April 2022. At the time of this writing, the CSAF field is in the process of being officially added.
+        The security.txt was published as [RFC9116] in April 2022. The CSAF field was officially added through the IANA registry.
       
    
     
    
     
    
-      Examples 1:
+      Examples 1:
     
    
     
    CSAF: https://domain.tld/security/data/csaf/provider-metadata.json
 CSAF: https://psirt.domain.tld/advisories/csaf/provider-metadata.json
@@ -8179,17 +8940,18 @@ 
    
       7.1.9 Requirement 9: Well-known URL for provider-metadata.json 
     
    
     
    
-      The URL path /.well-known/csaf/provider-metadata.json under the main domain of the issuing authority serves directly the provider-metadata.json according to requirement 7. The use of the scheme "HTTPS" is required. See [RFC8615] for more details.
+      The URL path /.well-known/csaf/provider-metadata.json under the main domain of the issuing authority serves directly the provider-metadata.json according to requirement 7. That implies that redirects SHALL NOT be used. The use of the scheme "HTTPS" is required. See [RFC8615] for more
+      details.
     
    
     
    
-      Example 1:
+      Example 1:
     
    
     
      https://www.example.com/.well-known/csaf/provider-metadata.json
    
     
    
       7.1.10 Requirement 10: DNS path 
     
    
     
    
-      The DNS record csaf.data.security.domain.tld SHALL resolve as a web server which serves directly the provider-metadata.json according to requirement 7. The use of the scheme "HTTPS" is required.
+      The DNS record csaf.data.security.domain.tld SHALL resolve as a web server which serves directly the provider-metadata.json according to requirement 7. That implies that redirects SHALL NOT be used. The use of the scheme "HTTPS" is required.
     
    
     
    
       7.1.11 Requirement 11: One folder per year 
@@ -8198,7 +8960,7 @@ 
    
       The CSAF documents MUST be located within folders named <YYYY> where <YYYY> is the year given in the value of /document/tracking/initial_release_date.
     
    
     
    
-      Examples 1:
+      Examples 1:
     
    
     
    2024
 2023
    
@@ -8209,7 +8971,7 @@ 
    
       The index.txt file within MUST provide a list of all filenames of CSAF documents which are located in the sub-directories with their filenames.
     
    
     
    
-      Example 1:
+      Example 1:
     
    
     
    2023/esa-2023-09953.json
 2022/esa-2022-02723.json
@@ -8227,7 +8989,7 @@ 
    
       The file changes.csv MUST contain the filename as well as the value of /document/tracking/current_release_date for each CSAF document in the sub-directories without a heading; lines MUST be sorted by the current_release_date timestamp with the latest one first.
     
    
     
    
-      Example 1:
+      Example 1:
     
    
     
    "2023/esa-2023-09953.json","2023-07-01T10:09:07Z"
 "2021/esa-2021-03676.json","2023-07-01T10:09:01Z"
@@ -8258,7 +9020,7 @@ 
    
       MUST exist. Each ROLIE feed document MUST be a JSON file that conforms with [RFC8322].
     
    
     
    
-      Example 1:
+      Example 1:
     
    
     
      {
     "feed": {
@@ -8324,7 +9086,7 @@ 
    
       the filename service.json and reside next to the provider-metadata.json.
     
    
     
    
-      Example 1:
+      Example 1:
     
    
     
      {
     "service": {
@@ -8391,7 +9153,7 @@ 
    
           type of product
         
    
         
    
-          Examples 1:
+          Examples 1:
         
    
         
      CPU
   Firewall
@@ -8407,7 +9169,7 @@ 
    
           areas or sectors, the products are used in
         
    
         
    
-          Examples 2:
+          Examples 2:
         
    
         
      Chemical
   Commercial
@@ -8425,7 +9187,7 @@ 
    
       
     
     
    
-      Example 3:
+      Example 3:
     
    
     
      {
     "categories": {
@@ -8449,7 +9211,7 @@ 
    
       MD5 and SHA1 SHOULD NOT be used.
     
    
     
    
-      Example 1:
+      Example 1:
     
    
     
    File name of CSAF document: esa-2022-02723.json
 File name of SHA-256 hash file: esa-2022-02723.json.sha256
@@ -8458,7 +9220,7 @@ 
    
       The file content SHALL start with the first byte of the hexadecimal hash value. Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
     
    
     
    
-      Example 2:
+      Example 2:
     
    
     
    ea6a209dba30a958a78d82309d6cdcc6929fcb81673b3dc4d6b16fac18b6ff38  esa-2022-02723.json
    
     
    
@@ -8471,7 +9233,7 @@ 
    
       All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is extended by the appropriate extension. See [RFC4880] for more details.
     
    
     
    
-      Example 1:
+      Example 1:
     
    
     
    File name of CSAF document: esa-2022-02723.json
 File name of signature file: esa-2022-02723.json.asc
    
@@ -8537,7 +9299,7 @@ 
    
       The file aggregator.json SHOULD only list the latest version of the metadata of a CSAF provider.
     
    
     
    
-      Example 1:
+      Example 1:
     
    
     
      {
     "aggregator": {
@@ -8594,7 +9356,7 @@ 
    
       
     
     
    
-      Example 1:
+      Example 1:
     
    
     
      {
     "aggregator": {
@@ -8921,6 +9683,9 @@ 
    
       
  • 
         CSAF document: A security advisory text document in the format defined by this document.
       
    • 
+      
  • 
+        CSAF downloader: A program that retrieves CSAF documents in an automated fashion.
+      
    • 
       
  • 
         CSAF producer: A program which emits output in the CSAF format.
       
    • 
@@ -8992,6 +9757,8 @@ 
    
       A text file or data stream satisfies the "CSAF document" conformance profile if it:
     
    
     
      
+      
    • conforms to the syntax and semantics defined in section 2.2
+      
      • 
       
    • conforms to the syntax and semantics defined in section 3.
       
      • 
       
    • satisfies at least one profile defined in section 4.
@@ -9112,8 +9879,26 @@ 
      
         /vulnerabilities[]/ids: If a vuln:ID element is given, the CVRF CSAF converter converts it into the first item of the ids array.
       
      • 
       
    • 
-        /vulnerabilities[]/remediation[]: If no product_ids or group_ids is given, the CVRF CSAF converter appends all Product IDs which are listed under ../product_status in the arrays known_affected, first_affected and last_affected into
-        product_ids. If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
+        /vulnerabilities[]/remediations[]:
+        
        
+          
      • If neither product_ids nor group_ids are given, the CVRF CSAF converter appends all Product IDs which are listed under ../product_status in the arrays known_affected, first_affected and last_affected into product_ids. If none of these
+          arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
+          
        • 
+          
      • The CVRF CSAF converter MUST convert any remediation with the type Vendor Fix into the category optional_patch if the product in question is in one of the product status groups "Not Affected" or "Fixed" for this vulnerability. Otherwise, the category vendor_fix MUST be set. If multiple
+          products are associated with the remediation - either directly or through a product group - and the products belong to different product status groups, the CVRF CSAF converter MUST duplicate the remediation, change the category in one instance to optional_patch and distribute the products accordingly as stated by the
+          conversion rule.
+          
        • 
+          
      • The CVRF CSAF converter MUST convert any remediation with the type None Available into the category fix_planned if the product in question is also listed in a remediation of the type Vendor Fix with a Date in the future or no Date at all. Consequently, the product
+          MUST be removed from the remediation of the category vendor_fix. If it was the last product in that remediation, the remediation MUST be removed.
+          
        • 
+          
      • The CVRF CSAF converter MUST remove any product from a remediation with the type None Available if the product in question is also listed in a remediation of the type Vendor Fix with a Date in the past or to the exact same time. If it was the last product in that remediation, the
+          remediation MUST be removed.
+          
        • 
+          
      • In any other case, the CVRF CSAF converter MUST preserve the product in the remediation of the category none_available.
+          
        • 
+          
      • The CVRF CSAF converter MUST output a warning if a remediation was added, deleted or the value of the category was changed, including the products it was changed for.
+          
        • 
+        
      
       
      • 
       
    • 
         /vulnerabilities[]/metrics[]:
@@ -9136,7 +9921,7 @@ 
      
                   Retrieve the CVSS version from the CVSS vector, if present.
                 
      
                 
      
-                  Example 1:
+                  Example 1:
                 
      
                 
        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H => 3.1
      
               
      • 
@@ -9145,7 +9930,7 @@ 
      
                   Retrieve the CVSS version from the CVSS element's namespace, if present. The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
                 
      
                 
      
-                  Example 2:
+                  Example 2:
                 
      
                 
        xmlns:cvssv31="https://www.first.org/cvss/cvss-v3.1.xsd"
   <!-- -->
@@ -9154,7 +9939,7 @@ 
      
                   is handled the same as
                 
      
                 
      
-                  Example 3:
+                  Example 3:
                 
      
                 
        <ScoreSetV3 xmlns="https://www.first.org/cvss/cvss-v3.1.xsd">
      
               
@@ -9164,7 +9949,7 @@ 
      
                   decision.
                 
      
                 
      
-                  Example 4:
+                  Example 4:
                 
      
                 
        xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" => 3.0
      
               
@@ -9948,7 +10733,7 @@ 
      
         
      
         
      
           
      
-            This is a common case for CSAF 2.0 documents labeled as TLP:RED but actually intended to be TLP:AMBER+STRICT.
+            This is a common case for CSAF 2.0 documents labeled as TLP:RED but actually intended to be TLP:AMBER+STRICT.
           
      
         
      
         
      
@@ -9980,6 +10765,27 @@ 
      
           The tool SHOULD implement an option to use the latest available CWE version at the time of the conversion that still matches.
         
      
       
+      
    • 
+        
      
+          /vulnerabilities[]/remediations[]:
+        
      
+        
        
+          
      • The CSAF 2.0 to CSAF 2.1 converter MUST convert any remediation with the category vendor_fix into the category optional_patch if the product in question is in one of the product status groups "Not Affected" or "Fixed" for this vulnerability. Otherwise, the category vendor_fix MUST stay the
+          same. If multiple products are associated with the remediation - either directly or through a product group - and the products belong to different product status groups, the CSAF 2.0 to CSAF 2.1 converter MUST duplicate the remediation, change the category in one instance to optional_patch and distribute the products
+          accordingly as stated by the conversion rule.
+          
        • 
+          
      • The CSAF 2.0 to CSAF 2.1 converter MUST convert any remediation with the category none_available into the category fix_planned if the product in question is also listed in a remediation of the category vendor_fix with a date in the future or no date at all.
+          Consequently, the product MUST be removed from the remediation of the category vendor_fix. If it was the last product in that remediation, the remediation MUST be removed.
+          
        • 
+          
      • The CSAF 2.0 to CSAF 2.1 converter MUST remove any product from a remediation with the category none_available if the product in question is also listed in a remediation of the category vendor_fix with a date in the past or to the exact same time. If it was the last product in that
+          remediation, the remediation MUST be removed.
+          
        • 
+          
      • In any other case, the CSAF 2.0 to CSAF 2.1 converter MUST preserve the product in the remediation of the category none_available.
+          
        • 
+          
      • The CSAF 2.0 to CSAF 2.1 converter MUST output a warning if a remediation was added, deleted or the value of the category was changed, including the products it was changed for.
+          
        • 
+        
      
+      
      • 
     
    
     
    
       
    
@@ -10111,6 +10917,27 @@ 
    
     
    
       A CSAF library does not satisfies the "CSAF library with full validation" conformance profile if the CSAF library uses an external library or program for the "CSAF full validator" part and does not enforce its presence.
     
    
+    
    
+      9.1.23 Conformance Clause 23: CSAF downloader 
+    
    
+    
    
+      A program satisfies the "CSAF downloader" conformance profile if the program:
+    
    
+    
      
+      
    • conforms to the process defined in section 7.3 by executing all parts that are applicable to the given role.
+      
      • 
+      
    • supports directory-based and ROLIE-based retrieval.
+      
      • 
+      
    • is able to execute both steps from section 7.3 separately.
+      
      • 
+      
    • uses a program-specific HTTP User Agent, e.g. consisting of the name and version of the program.
+      
      • 
+    
    
+    
    
+      
    
+        A tool MAY implement an option to store CSAF documents that fail any of the steps in section 7.3.2.
+      
    
+    
    
     
    
     
    
       Appendix A. Acknowledgments 
@@ -11483,6 +12310,20 @@ 
    
             Next Editor Revision
           
         
+        
+          
+            csaf-v2.0-wd20241030-dev
+          
+          
+            2024-10-30
+          
+          
+            Stefan Hagen and Thomas Schmidt
+          
+          
+            Next Editor Revision
+          
+        
       
     
     
    
diff --git a/csaf_2.1/prose/share/csaf-v2.1-draft.md b/csaf_2.1/prose/share/csaf-v2.1-draft.md
index c1a4af6f..efb04675 100644
--- a/csaf_2.1/prose/share/csaf-v2.1-draft.md
+++ b/csaf_2.1/prose/share/csaf-v2.1-draft.md
@@ -7,7 +7,7 @@
 
 ## Committee Specification Draft 01
 
-## 28 August 2024
+## 30 October 2024
 
 #### This stage:
 https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.md (Authoritative) \
@@ -71,7 +71,7 @@ When referencing this specification the following citation format should be used
 
 **[csaf-v2.1]**
 
-_Common Security Advisory Framework Version 2.1_. Edited by Stefan Hagen, and Thomas Schmidt. 28 August 2024. OASIS Committee Specification Draft 01. https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html.
+_Common Security Advisory Framework Version 2.1_. Edited by Stefan Hagen, and Thomas Schmidt. 30 October 2024. OASIS Committee Specification Draft 01. https://docs.oasis-open.org/csaf/csaf/v2.1/csd01/csaf-v2.1-csd01.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html.
 
 
 -------
@@ -110,6 +110,7 @@ The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the own
 	1.5 [Typographical Conventions](#typographical-conventions)  
 2. [Design Considerations](#design-considerations)  
 	2.1 [Construction Principles](#construction-principles)  
+	2.2 [Date and Time](#date-and-time)  
 3. [Schema Elements](#schema-elements)  
 	3.1 [Definitions](#definitions)  
 		3.1.1 [Acknowledgments Type](#acknowledgments-type)  
@@ -267,6 +268,9 @@ The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the own
 		6.1.31 [Version Range in Product Version](#version-range-in-product-version)  
 		6.1.32 [Flag without Product Reference](#flag-without-product-reference)  
 		6.1.33 [Multiple Flags with VEX Justification Codes per Product](#multiple-flags-with-vex-justification-codes-per-product)  
+		6.1.34 [Branches Recursion Depth](#mandatory-tests--branches-recursion-depth)  
+		6.1.35 [Contradicting Remediations](#contradicting-remediations)  
+		6.1.36 [Contradicting Product Status Remediation Combination](#contradicting-product-status-remediation-combination)  
 	6.2 [Optional Tests](#optional-tests)  
 		6.2.1 [Unused Definition of Product ID](#unused-definition-of-product-id)  
 		6.2.2 [Missing Remediation](#missing-remediation)  
@@ -277,7 +281,7 @@ The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the own
 		6.2.7 [Missing Date in Involvements](#missing-date-in-involvements)  
 		6.2.8 [Use of MD5 as the only Hash Algorithm](#use-of-md5-as-the-only-hash-algorithm)  
 		6.2.9 [Use of SHA-1 as the only Hash Algorithm](#use-of-sha-1-as-the-only-hash-algorithm)  
-		6.2.10 [Missing TLP label (deprecated)](#missing-tlp-label)  
+		6.2.10 [Missing TLP label (obsolete)](#missing-tlp-label)  
 		6.2.11 [Missing Canonical URL](#missing-canonical-url)  
 		6.2.12 [Missing Document Language](#missing-document-language)  
 		6.2.13 [Sorting](#optional-tests--sorting)  
@@ -294,6 +298,7 @@ The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the own
 		6.2.24 [Usage of Non-Latest CWE Version](#usage-of-non-latest-cwe-version)  
 		6.2.25 [Usage of CWE Not Allowed for Vulnerability Mapping](#usage-of-cwe-not-allowed-for-vulnerability-mapping)  
 		6.2.26 [Usage of CWE Allowed with Review for Vulnerability Mapping](#usage-of-cwe-allowed-with-review-for-vulnerability-mapping)  
+		6.2.27 [Discouraged Product Status Remediation Combination](#discouraged-product-status-remediation-combination)  
 	6.3 [Informative Test](#informative-test)  
 		6.3.1 [Use of CVSS v2 as the only Scoring System](#use-of-cvss-v2-as-the-only-scoring-system)  
 		6.3.2 [Use of CVSS v3.0](#use-of-cvss-v3-0)  
@@ -367,6 +372,7 @@ The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the own
 		9.1.20 [Conformance Clause 20: CSAF library with basic validation](#conformance-clause-20-csaf-library-with-basic-validation)  
 		9.1.21 [Conformance Clause 21: CSAF library with extended validation](#conformance-clause-21-csaf-library-with-extended-validation)  
 		9.1.22 [Conformance Clause 22: CSAF library with full validation](#conformance-clause-22-csaf-library-with-full-validation)  
+		9.1.23 [Conformance Clause 23: CSAF downloader](#conformance-clause-23-csaf-downloader)  
 
 Appendix A. [Acknowledgments](#acknowledgments)  
 Appendix B. [Revision History](#revision-history)  
@@ -434,6 +440,8 @@ For purposes of this document, the following terms and definitions apply:
   
    analysis tool which acts as a CSAF producer
    
   
    CSAF document
    
   
    security advisory text document in the format defined by this document.
    
+  
    CSAF downloader
    
+  
    A program that retrieves CSAF documents in an automated fashion.
    
   
    CSAF extended validator
    
   
    A CSAF basic validator that additionally performs optional tests.
    
   
    CSAF full validator
    
@@ -497,6 +505,8 @@ For purposes of this document, the following terms and definitions apply:
   
    property stored outside of the CSAF document to which it logically belongs
    
   
    false positive
    
   
    result which an end user decides does not actually represent a problem
    
+  
    filter
    
+  
    refine a list by selecting entries that match given criteria
    
   
    fingerprint
    
   
    stable value that can be used by a result management system to uniquely identify a result over time,
       even if a relevant artifact is modified
    
@@ -555,6 +565,8 @@ For purposes of this document, the following terms and definitions apply:
       Examples: severity level, rank
   
    repository
    
   
    container for a related set of files in a version control system
    
+  
    search
    
+  
    compile a list of entries that match given criteria
    
   
    taxonomy
    
   
    classification of analysis results into a set of categories
    
   
    tag
    
@@ -592,6 +604,8 @@ For purposes of this document, the following terms and definitions apply:
 
 ## 1.3 Normative References 
 
+**\[****ISO8601\]** _Data elements and interchange formats — Information interchange — Representation of dates and times_, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html.
+
 **\[****JSON-Schema-Core\]** _JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020, .
 
 **\[****JSON-Schema-Validation\]** _JSON Schema Validation: A Vocabulary for Structural Validation of JSON_, draft-bhutton-json-schema-validation-00, December 2020, .
@@ -602,6 +616,8 @@ For purposes of this document, the following terms and definitions apply:
 
 **\[****RFC2119\]** Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, .
 
+**\[****RFC3339\]** Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, .
+
 **\[****RFC7464\]** Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, .
 
 **\[****RFC8174\]** Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, .
@@ -644,8 +660,6 @@ For purposes of this document, the following terms and definitions apply:
 
 **\[****GFMENG\]** _GitHub Engineering: A formal spec for GitHub Flavored Markdown_, https://githubengineering.com/a-formal-spec-for-github-markdown/.
 
-**\[****ISO8601\]** _Data elements and interchange formats — Information interchange — Representation of dates and times_, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html.
-
 **\[****ISO19770-2\]** _Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015, .
 
 **\[****ISO29147\]** _Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018, .
@@ -654,8 +668,6 @@ For purposes of this document, the following terms and definitions apply:
 
 **\[****PURL\]** _Package URL (purl)_, GitHub Project, https://github.com/package-url/purl-spec.
 
-**\[****RFC3339\]** Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, .
-
 **\[****RFC3552\]** Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, .
 
 **\[****RFC3986\]** Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, .
@@ -811,6 +823,19 @@ Section [7](#distributing-csaf-documents) states how to distribute and where to
 Safety, Security and Data Protection are considered in section [8](#safety-security-and-data-protection-considerations).
 Finally, a set of conformance targets describes tools in the ecosystem.
 
+
+## 2.2 Date and Time 
+
+This standard uses the `date-time` format as defined in JSON Schema Draft 2020-12 Section 7.3.1.
+In accordance with RFC 3339 and ISO 8601, the following rules apply:
+
+* The letter `T` separating the date and time SHALL be upper case.
+* The letter `Z` indicating the timezone UTC SHALL be upper case.
+* Fractions of seconds are allowed as specified in the standards mention above with the full stop (`.`) as separator.
+* Leap seconds are supported. However, they SHOULD be avoided if possible.
+* Empty timezones are prohibited.
+* The ABNF of RFC 3339, section 5.6 applies.
+
 -------
 
 # 3. Schema Elements 
@@ -1250,29 +1275,28 @@ and `x_generic_uris`, one is mandatory.
         "cpe": {
           // ...
         },
-        "hashes": [
+        "hashes": {
           // ...
-        ],
-        "model_numbers": [
+        },
+        "model_numbers": {
           // ...
-        ],
+        },
         "purl": {
           // ...
         },
-        "sbom_urls": [
+        "sbom_urls": {
           // ...
-        ],
-        "serial_numbers": [
+        },
+        "serial_numbers": {
           // ...
-        ],
-        "skus": [
+        },
+        "skus": {
           // ...
-        ],
-        "x_generic_uris": [
+        },
+        "x_generic_uris": {
           // ...
-        ]
+        }
       }
-    }
 ```
 
 ##### 3.1.3.3.1 Full Product Name Type - Product Identification Helper - CPE 
@@ -1286,6 +1310,8 @@ Common Platform Enumeration representation (`cpe`) of value type `string` of 5 o
 The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification.
 See [CPE23-N] for details.
 
+> Both, CPE 2.2 and CPE 2.3, are supported in CSAF.
+
 ##### 3.1.3.3.2 Full Product Name Type - Product Identification Helper - Hashes 
 
 List of hashes (`hashes`) of value type `array` holding at least one item contains a list of cryptographic hashes usable to identify files.
@@ -1948,7 +1974,7 @@ This results in the following rules:
    1.0.0-0.3.7
    1.0.0-alpha
    1.0.0-alpha.1
-   1.0.0-x-y-z.–
+   1.0.0-x-y-z.--
    1.0.0-x.7.z.92
    ```
 
@@ -1962,7 +1988,7 @@ This results in the following rules:
 
     ```
     1.0.0+20130313144700
-    1.0.0+21AF26D3—-117B344092BD
+    1.0.0+21AF26D3----117B344092BD
     1.0.0-alpha+001
     1.0.0-beta+exp.sha.5114f85
     ```
@@ -2002,6 +2028,18 @@ This results in the following rules:
        1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
        ```
 
+Note, that the following values do no conform the semantic versioning described above.
+
+*Examples 6 (which are invalid):*
+
+```
+  1.16.13.14-Cor
+  1.0.0-x-y-z.–
+  1.0.0+21AF26D3—-117B344092BD
+  2.5.20+3f93da6b+7cc
+  3.20.0-00
+```
+
 ## 3.2 Properties 
 
 These final four subsections document the four properties of a CSAF document.
@@ -2110,7 +2148,7 @@ The Namespace of aggregate severity (`namespace`) of value type `string` with fo
 The Text of aggregate severity (`text`) of value type `string` with 1 or more characters provides a severity which is
 independent of - and in addition to - any other standard metric for determining the impact or severity of a given vulnerability (such as CVSS).
 
-*Examples 1:*
+*Examples 1:*
 
 ```
     Critical
@@ -2136,7 +2174,7 @@ Document category defines a short canonical name, chosen by the document produce
     }
 ```
 
-*Examples 1:*
+*Examples 1:*
 
 ```
     csaf_base
@@ -2179,7 +2217,7 @@ If both values are present, the TLP information SHOULD be preferred as this aids
 
 The Textual description (`text`) of value type `string` with 1 or more characters provides a textual description of additional constraints.
 
-*Examples 1:*
+*Examples 1:*
 
 ```
     Copyright 2024, Example Company, All Rights Reserved.
@@ -2234,7 +2272,7 @@ The default value is the URL to the definition by FIRST:
     https://www.first.org/tlp/
 ```
 
-*Examples 1:*
+*Examples 1:*
 
 ```
     https://www.us-cert.gov/tlp
@@ -2343,7 +2381,7 @@ product resellers and distributors, including authoritative vendor partners.
 Contact details (`contact_details`) of value type `string` with 1 or more characters provides information on how to contact the publisher,
 possibly including details such as web sites, email addresses, phone numbers, and postal mail addresses.
 
-*Example 1:*
+*Example 1:*
 
 ```
     Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact.
@@ -2358,7 +2396,7 @@ the authority of the issuing party to release the document, in particular, the p
 
 The Name of publisher (`name`) of value type `string` with 1 or more characters contains the name of the issuing party.
 
-*Example 1:*
+*Example 1:*
 
 ```
      BSI
@@ -2385,7 +2423,7 @@ an incremented (patch) version which has no other changes than:
 * the updated item in `/document/references[]` which points to the new version of the CSAF document
 * an added item in `/document/references[]` which points to the previous version of the CSAF document (if the URL changed)
 
-*Examples 1:*
+*Examples 1:*
 
 ```
     https://csaf.io
@@ -2420,7 +2458,7 @@ The property SHALL NOT be present if the document was not translated.
 Title of this document (`title`) of value type `string` with 1 or more characters SHOULD be a canonical name for the document,
 and sufficiently unique to distinguish it from similar documents.
 
-*Examples 1:*
+*Examples 1:*
 
 ```
     Cisco IPv6 Crafted Packet Denial of Service Vulnerability
@@ -2483,7 +2521,7 @@ list of alternate names for the same document.
 Every such Alternate Name of value type `string` with 1 or more characters specifies a non-empty string that represents a
 distinct optional alternative ID used to refer to the document.
 
-*Example 1:*
+*Example 1:*
 
 ```
     CVE-2019-12345
@@ -2537,7 +2575,7 @@ optional property Engine version (`version`) contains information about the engi
 
 Engine name (`name`) of value type `string` with 1 or more characters represents the name of the engine that generated the CSAF document.
 
-*Examples 1:*
+*Examples 1:*
 
 ```
     Red Hat rhsa-to-cvrf
@@ -2550,7 +2588,7 @@ Engine version (`version`) of value type `string` with 1 or more characters cont
 > Although it is not formally required, the TC suggests to use a versioning which is compatible with Semantic Versioning as described in
 > the external specification [SemVer]. This could help the end user to identify when CSAF consumers have to be updated.
 
-*Examples 2:*
+*Examples 2:*
 
 ```
     0.6.0
@@ -2573,7 +2611,7 @@ Unique identifier for the document holds the Identifier.
 The ID is a simple label that provides for a wide range of numbering values, types, and schemes.
 Its value SHOULD be assigned and maintained by the original document issuing authority. It MUST be unique for that organization.
 
-*Examples 1:*
+*Examples 1:*
 
 ```
     Example Company - 2019-YH3234
@@ -2741,7 +2779,7 @@ the optional Summary (`summary`) property.
 
 The summary of the product group (`summary`) of value type `string` with 1 or more characters gives a short, optional description of the group.
 
-*Examples 1:*
+*Examples 1:*
 
 ```
     Products supporting Modbus.
@@ -2830,7 +2868,7 @@ which is referenced as the first element of the relationship.
 Relates to Product Reference (`relates_to_product_reference`) of value type Product ID (`product_id_t`) holds a Product ID that refers to
 the Full Product Name element, which is referenced as the second element of the relationship.
 
-*Examples 1:*
+*Examples 1:*
 
 ```
   "product_tree": {
@@ -2996,7 +3034,7 @@ The Weakness ID (`id`) has value type `string` with `pattern` (regular expressio
 
 It holds the ID for the weakness associated.
 
-*Examples 1:*
+*Examples 1:*
 
 ```
     CWE-22
@@ -3007,7 +3045,7 @@ It holds the ID for the weakness associated.
 The Weakness name (`name`) has value type `string` with 1 or more characters and holds the full name of the weakness as given
 in the CWE specification.
 
-*Examples 2:*
+*Examples 2:*
 
 ```
     Cross-Site Request Forgery (CSRF)
@@ -3024,7 +3062,7 @@ The CWE version (`version`) has value type `string` with `pattern` (regular expr
 It holds the version string of the CWE specification this weakness was extracted from.
 When creating or modifying a CSAF document, the latest published version of the CWE specification SHOULD be used.
 
-*Examples 3:*
+*Examples 3:*
 
 ```
     "1.0",
@@ -3137,7 +3175,7 @@ tracking ID for the vulnerability.
 
 System name (`system_name`) of value type `string` with 1 or more characters indicates the name of the vulnerability tracking or numbering system.
 
-*Examples 1:*
+*Examples 1:*
 
 ```
     Cisco Bug ID
@@ -3146,7 +3184,7 @@ System name (`system_name`) of value type `string` with 1 or more characters ind
 
 Text (`text`) of value type `string` with 1 or more characters is unique label or tracking ID for the vulnerability (if such information exists).
 
-*Examples 2:*
+*Examples 2:*
 
 ```
     CSCso66472
@@ -3496,9 +3534,11 @@ Category of the remediation (`category`) of value type `string` and `enum` speci
 Valid values are:
 
 ```
+    fix_planned
     mitigation
     no_fix_planned
     none_available
+    optional_patch
     vendor_fix
     workaround
 ```
@@ -3516,20 +3556,56 @@ and they MAY or MAY NOT be officially sanctioned by the document producer.
 The value `vendor_fix` indicates that the remediation contains information about an official fix that
 is issued by the original author of the affected product.
 Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
-This value contradicts with the categories `none_available` and `no_fix_planned` for the same product.
-Therefore, such a combination can't be used in the list of remediations.
+
+The value `optional_patch` indicates that the remediation contains information about an patch that
+is issued by the original author of the affected product.
+Its application is not necessary, but might be desired by the user, e.g. to calm a security scanner by
+updating a dependency to a fixed version even though the dependency in the affected version was used
+in the product in a way that the product itself was not affected.
+Unless otherwise noted, it is assumed that this does not change the state regarding the vulnerability.
+
+> This is sometimes also referred to as a "regulatory compliance patch".
 
 The value `none_available` indicates that there is currently no fix or other remediation available.
 The text in field `details` SHOULD contain details about why there is no fix or other remediation.
-The values `none_available` and `vendor_fix` are mutually exclusive per product.
 
-> An issuing party might choose to use this category to announce that a fix is currently developed.
-It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
+The value `fix_planned` indicates that there is a fix for the vulnerability planned but not yet ready.
+An issuing party might choose to use this category to announce that a fix is currently developed.
+The text in field `details` SHOULD contain details including a date when a customer can expect the fix to be ready and distributed.
 
 The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time.
 This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated.
 The text in field `details` SHOULD contain details about why there will be no fix issued.
-The values `no_fix_planned` and `vendor_fix` are mutually exclusive per product.
+
+Some category values contradict each other and thus are mutually exclusive per product.
+Therefore, such a combination MUST NOT be used in the list of remediations for the same product.
+This is independent from whether the product is referenced directly or indirectly through a product group.
+The following tables shows the allowed and prohibited combinations:
+
+| category value   | `workaround` | `mitigation` | `vendor_fix` | `optional_patch` | `none_available` | `fix_planned` | `no_fix_planned` |
+|:----------------:|:------------:|:------------:|:------------:|:----------------:|:----------------:|:-------------:|:----------------:|
+| `workaround`     | allowed      | allowed      | allowed      | prohibited       | prohibited       | allowed       | allowed          |
+| `mitigation`     | allowed      | allowed      | allowed      | prohibited       | prohibited       | allowed       | allowed          |
+| `vendor_fix`     | allowed      | allowed      | allowed      | prohibited       | prohibited       | prohibited    | prohibited       |
+| `optional_patch` | prohibited   | prohibited   | prohibited   | allowed          | prohibited       | prohibited    | prohibited       |
+| `none_available` | prohibited   | prohibited   | prohibited   | prohibited       | allowed          | prohibited    | prohibited       |
+| `fix_planned`    | allowed      | allowed      | prohibited   | prohibited       | prohibited       | allowed       | prohibited       |
+| `no_fix_planned` | allowed      | allowed      | prohibited   | prohibited       | prohibited       | prohibited    | allowed          |
+
+Some category values contradict certain product status groups.
+Therefore, such a combination MUST NOT exist in a vulnerability item for the same product.
+This is independent from whether the product is referenced directly or indirectly through a product group.
+The following tables shows the allowed, discouraged and prohibited combinations:
+
+| category value   | Affected   | Not Affected | Fixed       | Under Investigation | Recommended |
+|:----------------:|:----------:|:------------:|:-----------:|:-------------------:|:-----------:|
+| `workaround`     | allowed    | prohibited   | prohibited  | discouraged         | allowed     |
+| `mitigation`     | allowed    | prohibited   | prohibited  | discouraged         | allowed     |
+| `vendor_fix`     | allowed    | prohibited   | prohibited  | discouraged         | allowed     |
+| `optional_patch` | prohibited | allowed      | discouraged | allowed             | allowed     |
+| `none_available` | allowed    | prohibited   | prohibited  | allowed             | allowed     |
+| `fix_planned`    | allowed    | discouraged  | prohibited  | discouraged         | allowed     |
+| `no_fix_planned` | allowed    | discouraged  | prohibited  | allowed             | allowed     |
 
 ##### 3.2.4.13.2 Vulnerabilities Property - Remediations - Date 
 
@@ -3887,7 +3963,7 @@ The following rules MUST be applied to determine the filename for the CSAF docum
    > As a result, a `/document/tracking/id` with the value `2022_#01-A` is converted into `2022_01-a` instead of `2022__01-a`.
 3. The file extension `.json` MUST be appended.
 
-*Examples 1:*
+*Examples 1:*
 
 ```
   cisco-sa-20190513-secureboot.json
@@ -3898,7 +3974,7 @@ The following rules MUST be applied to determine the filename for the CSAF docum
 > It is currently considered best practice to indicate that a CSAF document is invalid by
 > inserting `_invalid` into the filename in front of the file extension.
 
-*Examples 2:*
+*Examples 2:*
 
 ```
   cisco-sa-20190513-secureboot_invalid.json
@@ -3983,7 +4059,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/threats[]/product_ids[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4014,7 +4090,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_id
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4048,7 +4124,7 @@ The relevant path for this test is:
 > a Product ID defined in a relationship item is used as `product_reference` or `relates_to_product_reference`.
 > Only for those which fulfill this condition it is necessary to run the full check following the references.
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4087,7 +4163,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/threats[]/group_ids
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4126,7 +4202,7 @@ The relevant path for this test is:
     /product_tree/product_groups[]/group_id
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4202,7 +4278,7 @@ Contradiction groups are:
 > Note: An issuer might recommend (`/vulnerabilities[]/product_status/recommended`) a product version from any group - also from the affected group,
 > i.e. if it was discovered that fixed versions introduce a more severe vulnerability.
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4241,7 +4317,7 @@ The relevant path for this test is:
     /vulnerabilities[]/metrics[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4300,7 +4376,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/metrics[]/content/cvss_v4
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
@@ -4341,7 +4417,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/metrics[]/content/cvss_v4/environmentalSeverity
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
@@ -4368,7 +4444,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/metrics[]/content/cvss_v4
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
@@ -4402,7 +4478,7 @@ The relevant path for this test is:
     /vulnerabilities[]/cwes[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "cwes": [
@@ -4427,7 +4503,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "lang": "EZ"
@@ -4449,7 +4525,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/purl
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4479,7 +4555,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "revision_history": [
@@ -4508,7 +4584,7 @@ The relevant path for this test is:
     /document/source_lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -4539,7 +4615,7 @@ The relevant path for this test is:
     /document/tracking/version
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "tracking": {
@@ -4573,7 +4649,7 @@ The relevant path for this test is:
     /document/tracking/status
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -4595,7 +4671,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -4629,7 +4705,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "revision_history": [
@@ -4658,7 +4734,7 @@ The relevant path for this test is:
     /document/tracking/version
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -4684,7 +4760,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "revision_history": [
@@ -4713,7 +4789,7 @@ The relevant path for this test is:
     /document/tracking/revision_history
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
    "revision_history": [
@@ -4742,7 +4818,7 @@ The relevant path for this test is:
     /vulnerabilities[]/cve
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -4767,7 +4843,7 @@ The relevant path for this test is:
     /vulnerabilities[]/involvements
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -4803,7 +4879,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -4863,7 +4939,7 @@ The relevant path for this test is:
   /document/category
 ```
 
-*Examples 1 (for currently prohibited values):*
+*Examples 1 (for currently prohibited values):*
 
 ```
   Csaf_a
@@ -4874,7 +4950,7 @@ The relevant path for this test is:
   V_eX
 ```
 
-*Example 2 (which fails the test):*
+*Example 2 (which fails the test):*
 
 ```
   "category": "Security_Incident_Response"
@@ -4908,7 +4984,7 @@ The relevant path for this test is:
   /document/notes
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "notes": [
@@ -4939,7 +5015,7 @@ The relevant path for this test is:
   /document/references
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "references": [
@@ -4969,7 +5045,7 @@ The relevant path for this test is:
   /vulnerabilities
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -5000,7 +5076,7 @@ The relevant path for this test is:
   /product_tree
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   {
@@ -5032,7 +5108,7 @@ The relevant path for this test is:
   /vulnerabilities[]/notes
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -5060,7 +5136,7 @@ The relevant path for this test is:
   /vulnerabilities[]/product_status
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -5092,7 +5168,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/under_investigation
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_status": {
@@ -5124,7 +5200,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/ids
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -5155,7 +5231,7 @@ The relevant path for this test is:
   /vulnerabilities[]/threats
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5227,7 +5303,7 @@ The relevant path for this test is:
   /vulnerabilities[]/remediations
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5300,7 +5376,7 @@ The relevant path for this test is:
   /vulnerabilities
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   {
@@ -5326,7 +5402,7 @@ The relevant path for this test is:
   /document/source_lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -5354,7 +5430,7 @@ The relevant path for this test is:
   /vulnerabilities[]/remediations[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
       "remediations": [
@@ -5381,7 +5457,7 @@ The relevant paths for this test are:
   /document/tracking/version
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -5436,7 +5512,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
             "branches": [
@@ -5460,7 +5536,7 @@ The relevant path for this test is:
   /vulnerabilities[]/flags[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
       "flags": [
@@ -5487,7 +5563,7 @@ The relevant path for this test is:
   /vulnerabilities[]/flags
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5541,6 +5617,287 @@ The relevant path for this test is:
 
 > There are two flags given for `CSAFPID-9080700` - one indirect through `CSAFGID-0001` and one direct.
 
+### 6.1.34 Branches Recursion Depth 
+
+For each product defined under `/product_tree/branches[]` it MUST be tested that the complete JSON path
+does not contain more than 30 instances of `branches`.
+
+The relevant path for this test is:
+
+```
+  /product_tree/branches[](/branches[])*/product
+```
+
+*Example 1 (which fails the test):*
+
+```
+  "product_tree": {
+    "branches": [
+      {
+        "branches": [
+          {
+            "branches": [
+              {
+                "branches": [
+                  {
+                    "branches": [
+                      {
+                        "branches": [
+                          {
+                            "branches": [
+                              {
+                                "branches": [
+                                  {
+                                    "branches": [
+                                      {
+                                        "branches": [
+                                          {
+                                            "branches": [
+                                              {
+                                                "branches": [
+                                                  {
+                                                    "branches": [
+                                                      {
+                                                        "branches": [
+                                                          {
+                                                            "branches": [
+                                                              {
+                                                                "branches": [
+                                                                  {
+                                                                    "branches": [
+                                                                      {
+                                                                        "branches": [
+                                                                          {
+                                                                            "branches": [
+                                                                              {
+                                                                                "branches": [
+                                                                                  {
+                                                                                    "branches": [
+                                                                                      {
+                                                                                        "branches": [
+                                                                                          {
+                                                                                            "branches": [
+                                                                                              {
+                                                                                                "branches": [
+                                                                                                  {
+                                                                                                    "branches": [
+                                                                                                      {
+                                                                                                        "branches": [
+                                                                                                          {
+                                                                                                            "branches": [
+                                                                                                              {
+                                                                                                                "branches": [
+                                                                                                                  {
+                                                                                                                    "branches": [
+                                                                                                                      {
+                                                                                                                        "branches": [
+                                                                                                                          {
+                                                                                                                            "branches": [
+                                                                                                                              {
+                                                                                                                                "category": "product_name",
+                                                                                                                                "name": "branches",
+                                                                                                                                "product": {
+                                                                                                                                  "name": "<>",
+                                                                                                                                  "product_id": "CSAFPID-9080700"
+                                                                                                                                }
+                                                                                                                              }
+                                                                                                                            ],
+                                                                                                                            "category": "product_family",
+                                                                                                                            "name": "31"
+                                                                                                                          }
+                                                                                                                        ],
+                                                                                                                        "category": "product_family",
+                                                                                                                        "name": "with"
+                                                                                                                      }
+                                                                                                                    ],
+                                                                                                                    "category": "product_family",
+                                                                                                                    "name": "test"
+                                                                                                                  }
+                                                                                                                ],
+                                                                                                                "category": "product_family",
+                                                                                                                "name": "the"
+                                                                                                              }
+                                                                                                            ],
+                                                                                                            "category": "product_family",
+                                                                                                            "name": "fail"
+                                                                                                          }
+                                                                                                        ],
+                                                                                                        "category": "product_family",
+                                                                                                        "name": "and"
+                                                                                                      }
+                                                                                                    ],
+                                                                                                    "category": "product_family",
+                                                                                                    "name": "limits"
+                                                                                                  }
+                                                                                                ],
+                                                                                                "category": "product_family",
+                                                                                                "name": "the"
+                                                                                              }
+                                                                                            ],
+                                                                                            "category": "product_family",
+                                                                                            "name": "testing"
+                                                                                          }
+                                                                                        ],
+                                                                                        "category": "product_family",
+                                                                                        "name": "are"
+                                                                                      }
+                                                                                    ],
+                                                                                    "category": "product_family",
+                                                                                    "name": "they"
+                                                                                  }
+                                                                                ],
+                                                                                "category": "product_family",
+                                                                                "name": "but"
+                                                                              }
+                                                                            ],
+                                                                            "category": "product_family",
+                                                                            "name": "unrealistic"
+                                                                          }
+                                                                        ],
+                                                                        "category": "product_family",
+                                                                        "name": "less"
+                                                                      }
+                                                                    ],
+                                                                    "category": "product_family",
+                                                                    "name": "or"
+                                                                  }
+                                                                ],
+                                                                "category": "product_family",
+                                                                "name": "more"
+                                                              }
+                                                            ],
+                                                            "category": "product_family",
+                                                            "name": "and"
+                                                          }
+                                                        ],
+                                                        "category": "product_family",
+                                                        "name": "unnecessary"
+                                                      }
+                                                    ],
+                                                    "category": "product_family",
+                                                    "name": "seem"
+                                                  }
+                                                ],
+                                                "category": "product_family",
+                                                "name": "which"
+                                              }
+                                            ],
+                                            "category": "product_family",
+                                            "name": "product"
+                                          }
+                                        ],
+                                        "category": "product_family",
+                                        "name": "hypothetical"
+                                      }
+                                    ],
+                                    "category": "product_family",
+                                    "name": "this"
+                                  }
+                                ],
+                                "category": "product_family",
+                                "name": "for"
+                              }
+                            ],
+                            "category": "product_family",
+                            "name": "structure"
+                          }
+                        ],
+                        "category": "product_family",
+                        "name": "nested"
+                      }
+                    ],
+                    "category": "product_family",
+                    "name": "deeply"
+                  }
+                ],
+                "category": "product_family",
+                "name": "a"
+              }
+            ],
+            "category": "product_family",
+            "name": "uses"
+          }
+        ],
+        "category": "vendor",
+        "name": "Example Company"
+      }
+    ]
+  }
+```
+
+> The complete JSON path contains 31 times `branches`.
+
+### 6.1.35 Contradicting Remediations 
+
+For each item in `/vulnerabilities[]/remediations` it MUST be tested that a product is not member of contradicting remediation categories.
+This takes indirect relations through product groups into account.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/remediations[]
+```
+
+*Example 1 (which fails the test):*
+
+```
+      "remediations": [
+        {
+          "category": "no_fix_planned",
+          "details": "The product is end-of-life. Therefore, no fix will be provided.",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        },
+        {
+          "category": "vendor_fix",
+          "details": "Update to version >=14.3 to fix the vulnerability.",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+```
+
+> The two remediations given for the product with product ID `CSAFPID-908070` contradict each other.
+
+> A tool MAY apply the conversion rules from the conformance target CSAF 2.0 to CSAF 2.1 converter if applicable or
+> remove the product from the remediation with the lower priority.
+> The priority MAY be defined as follows:
+> `vendor_fix` > `mitigation` > `workaround` > `fix_planned` > `no_fix_planned` > `optional_patch` > `none_available`
+
+### 6.1.36 Contradicting Product Status Remediation Combination 
+
+For each item in `/vulnerabilities[]/remediations` it MUST be tested that a product is not member of a contradicting product status group.
+This takes indirect relations through product groups into account.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/remediations[]
+```
+
+*Example 1 (which fails the test):*
+
+```
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "vendor_fix",
+          "details": "Update to version >=14.3 to fix the vulnerability.",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+```
+
+> For the product with product ID `CSAFPID-908070` a `vendor_fix` is given but the product was not affected at all.
+
 ## 6.2 Optional Tests 
 
 Optional tests SHOULD NOT fail at a valid CSAF document without a good reason. Failing such a test does not make the CSAF document invalid.
@@ -5562,7 +5919,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_id
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5595,7 +5952,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/under_investigation[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5632,7 +5989,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/product_status/last_affected[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5666,7 +6023,7 @@ The relevant path for this test is:
     /document/tracking/revision_history[]/number
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "revision_history": [
@@ -5691,7 +6048,7 @@ The relevant path for this test is:
     /document/tracking/initial_release_date
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -5727,7 +6084,7 @@ The relevant path for this test is:
     /document/tracking/current_release_date
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "tracking": {
@@ -5762,7 +6119,7 @@ The relevant path for this test is:
     /vulnerabilities[]/involvements
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -5794,7 +6151,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5837,7 +6194,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -5865,27 +6222,10 @@ The relevant paths for this test are:
 
 > The hash algorithm `sha1` is used in one item of hashes without being accompanied by a second hash algorithm.
 
-### 6.2.10 Missing TLP label (deprecated) 
-
-It MUST be tested that `/document/distribution/tlp/label` is present and valid.
+### 6.2.10 Missing TLP label (obsolete) 
 
-> TLP labels support the machine-readability and automated distribution.
-
-The relevant path for this test is:
-
-```
-  /document/distribution/tlp/label
-```
-
-*Example 1 (which fails the test):*
-
-```
-    "distribution": {
-      "text": "Distribute freely."
-    }
-```
-
-> The CSAF document has no TLP label.
+> The TLP label is now required by the schema. Therefore, the optional test is obsolete.
+> This section is kept to document that change and keep the numbering of the remaining sections stable.
 
 ### 6.2.11 Missing Canonical URL 
 
@@ -5903,7 +6243,7 @@ The relevant path for this test is:
   /document/references
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -5938,7 +6278,7 @@ The relevant path for this test is:
   /document/lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -5968,7 +6308,7 @@ The relevant path for this test is:
   /
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -5993,7 +6333,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "lang": "qtx"
@@ -6014,7 +6354,7 @@ The relevant paths for this test are:
   /document/source_lang
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "lang": "i-default"
@@ -6036,7 +6376,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "full_product_names": [
@@ -6061,7 +6401,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/ids[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
       "ids": [
@@ -6094,7 +6434,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
             "branches": [
@@ -6122,7 +6462,7 @@ The relevant path for this test is:
   /vulnerabilities[]/product_status/fixed[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -6178,7 +6518,7 @@ The relevant path for this test is:
 > To implement this test it is deemed sufficient to validate the CSAF document against a "strict" version schema that
 > sets `additionalProperties` to `false` for every key of type `object`.
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -6204,7 +6544,7 @@ The relevant path for this test is:
   /document/tracking/revision_history[]/date
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "revision_history": [
@@ -6233,7 +6573,7 @@ The relevant path for this test is:
   /document/title
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "title": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-22-01: Optional test: Document Tracking ID in Title (failing example 1)",
@@ -6259,7 +6599,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cwes[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
      "cwes": [
@@ -6286,7 +6626,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cwes[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -6326,7 +6666,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cwes[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
       "cwes": [
@@ -6353,7 +6693,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cwes[]
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
       "cwes": [
@@ -6367,6 +6707,39 @@ The relevant path for this test is:
 
 > The usage of CWE-1023 is allowed with review as the "CWE entry is a Class and might have Base-level children that would be more appropriate". [cite](https://cwe.mitre.org/data/definitions/1023.html#Vulnerability_Mapping_Notes_1023)
 
+### 6.2.27 Discouraged Product Status Remediation Combination 
+
+For each item in `/vulnerabilities[]/remediations` it MUST be tested that a Product is not member of a discouraged product status group
+remediation category combination.
+This takes indirect relations through Product Groups into account.
+
+The relevant path for this test is:
+
+```
+  /vulnerabilities[]/remediations[]
+```
+
+*Example 1 (which fails the test):*
+
+```
+      "product_status": {
+        "known_not_affected": [
+          "CSAFPID-9080700"
+        ]
+      },
+      "remediations": [
+        {
+          "category": "fix_planned",
+          "details": "The fix should be available in Q4 2024.",
+          "product_ids": [
+            "CSAFPID-9080700"
+          ]
+        }
+      ]
+```
+
+> For the product with product ID `CSAFPID-908070` a fix is planned but the product was not affected at all.
+
 ## 6.3 Informative Test 
 
 Informative tests provide insights in common mistakes and bad practices.
@@ -6389,7 +6762,7 @@ The relevant path for this test is:
     /vulnerabilities[]/metrics
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -6437,7 +6810,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/metrics[]/content/cvss_v3/vectorString
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "cvss_v3": {
@@ -6469,7 +6842,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cve
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -6497,7 +6870,7 @@ The relevant path for this test is:
   /vulnerabilities[]/cwe
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "vulnerabilities": [
@@ -6522,7 +6895,7 @@ The relevant paths for this test are:
   /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -6583,7 +6956,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/remediations[]/url
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "references": [
@@ -6612,7 +6985,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/references[]/url
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "references": [
@@ -6673,7 +7046,7 @@ The relevant paths for this test are:
   /vulnerabilities[]/title
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "document": {
@@ -6705,7 +7078,7 @@ The relevant paths for this test are:
   /product_tree/branches
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
     "branches": [
@@ -6747,7 +7120,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/category
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
                 "category": "product_version_range",
@@ -6772,7 +7145,7 @@ The relevant paths for this test are:
   /product_tree/branches[](/branches[])*/name
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
             "branches": [
@@ -6796,7 +7169,7 @@ The relevant path for this test is:
     /vulnerabilities[]/metrics[]/content
 ```
 
-*Example 1 (which fails the test):*
+*Example 1 (which fails the test):*
 
 ```
   "product_tree": {
@@ -6884,6 +7257,8 @@ Redirects SHOULD NOT be used. If they are inevitable only HTTP Header redirects
 
 > Reasoning: Clients should not parse the payload for navigation and some, as e.g. `curl`, do not follow any other kind of redirects.
 
+If any redirects are used, there SHOULD not be more than 5 and MUST NOT be more than 10 consecutive redirects.
+
 ### 7.1.7 Requirement 7: provider-metadata.json 
 
 The party MUST provide a valid `provider-metadata.json` according to the schema
@@ -6904,7 +7279,7 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
 > * https://psirt.domain.tld/advisories/csaf/provider-metadata.json
 > * https://domain.tld/security/csaf/provider-metadata.json
 
-*Example 1 (minimal with ROLIE document):*
+*Example 1 (minimal with ROLIE document):*
 
 ```
   {
@@ -6962,10 +7337,10 @@ In the security.txt there MUST be at least one field `CSAF` which points to the
 If this field indicates a web URI, then it MUST begin with "https://" (as per section 2.7.2 of \[[RFC7230](#RFC7230)\]).
 See \[[SECURITY-TXT](#SECURITY-TXT)\] for more details.
 
-> The security.txt was published as \[[RFC9116](#RFC9116)\] in April 2022. At the time of this writing,
-> the `CSAF` field is in the process of being officially added.
+> The security.txt was published as \[[RFC9116](#RFC9116)\] in April 2022.
+> The `CSAF` field was officially added through the IANA registry.
 
-*Examples 1:*
+*Examples 1:*
 
 ```
 CSAF: https://domain.tld/security/data/csaf/provider-metadata.json
@@ -6982,10 +7357,10 @@ If one of the URLs fulfills requirement 9, this MUST be used as the first CSAF e
 ### 7.1.9 Requirement 9: Well-known URL for provider-metadata.json 
 
 The URL path `/.well-known/csaf/provider-metadata.json` under the main domain of the issuing authority serves directly
-the `provider-metadata.json` according to requirement 7.
+the `provider-metadata.json` according to requirement 7. That implies that redirects SHALL NOT be used.
 The use of the scheme "HTTPS" is required. See \[[RFC8615](#RFC8615)\] for more details.
 
-*Example 1:*
+*Example 1:*
 
 ```
   https://www.example.com/.well-known/csaf/provider-metadata.json
@@ -6994,7 +7369,7 @@ The use of the scheme "HTTPS" is required. See \[[RFC8615](#RFC8615)\] for more
 ### 7.1.10 Requirement 10: DNS path 
 
 The DNS record `csaf.data.security.domain.tld` SHALL resolve as a web server which serves directly
-the `provider-metadata.json` according to requirement 7.
+the `provider-metadata.json` according to requirement 7. That implies that redirects SHALL NOT be used.
 The use of the scheme "HTTPS" is required.
 
 ### 7.1.11 Requirement 11: One folder per year 
@@ -7002,7 +7377,7 @@ The use of the scheme "HTTPS" is required.
 The CSAF documents MUST be located within folders named `` where `` is the year given in the
 value of `/document/tracking/initial_release_date`.
 
-*Examples 1:*
+*Examples 1:*
 
 ```
 2024
@@ -7013,7 +7388,7 @@ value of `/document/tracking/initial_release_date`.
 
 The index.txt file within MUST provide a list of all filenames of CSAF documents which are located in the sub-directories with their filenames.
 
-*Example 1:*
+*Example 1:*
 
 ```
 2023/esa-2023-09953.json
@@ -7029,7 +7404,7 @@ The index.txt file within MUST provide a list of all filenames of CSAF documents
 The file changes.csv MUST contain the filename as well as the value of `/document/tracking/current_release_date` for each
 CSAF document in the sub-directories without a heading; lines MUST be sorted by the `current_release_date` timestamp with the latest one first.
 
-*Example 1:*
+*Example 1:*
 
 ```
 "2023/esa-2023-09953.json","2023-07-01T10:09:07Z"
@@ -7056,7 +7431,7 @@ At least one of the feeds
 MUST exist.
 Each ROLIE feed document MUST be a JSON file that conforms with \[[RFC8322](#RFC8322)\].
 
-*Example 1:*
+*Example 1:*
 
 ```
   {
@@ -7125,7 +7500,7 @@ If it is used, each ROLIE service document MUST be a JSON file that conforms wit
 Additionally, it can also list the corresponding ROLIE category documents.
 The ROLIE service document SHOULD use the filename `service.json` and reside next to the `provider-metadata.json`.
 
-*Example 1:*
+*Example 1:*
 
 ```
   {
@@ -7169,7 +7544,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
   * `product_version`
 * type of product
 
-  *Examples 1:*
+  *Examples 1:*
 
   ```
     CPU
@@ -7184,7 +7559,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
 
 * areas or sectors, the products are used in
 
-  *Examples 2:*
+  *Examples 2:*
 
   ```
     Chemical
@@ -7199,7 +7574,7 @@ ROLIE categories SHOULD be used for to further dissect CSAF documents by one or
 
 * any other categorization useful to the consumers
 
-*Example 3:*
+*Example 3:*
 
 ```
   {
@@ -7223,7 +7598,7 @@ to ensure their integrity. The filename is constructed by appending the file ext
 
 MD5 and SHA1 SHOULD NOT be used.
 
-*Example 1:*
+*Example 1:*
 
 ```
 File name of CSAF document: esa-2022-02723.json
@@ -7234,7 +7609,7 @@ File name of SHA-512 hash file: esa-2022-02723.json.sha512
 The file content SHALL start with the first byte of the hexadecimal hash value.
 Any subsequent data (like a filename) which is optional SHALL be separated by at least one space.
 
-*Example 2:*
+*Example 2:*
 
 ```
 ea6a209dba30a958a78d82309d6cdcc6929fcb81673b3dc4d6b16fac18b6ff38  esa-2022-02723.json
@@ -7247,7 +7622,7 @@ If a ROLIE feed exists, each hash file MUST be listed in it as described in requ
 All CSAF documents SHALL have at least one OpenPGP signature file which is provided under the same filename which is
 extended by the appropriate extension. See \[[RFC4880](#RFC4880)\] for more details.
 
-*Example 1:*
+*Example 1:*
 
 ```
 File name of CSAF document: esa-2022-02723.json
@@ -7292,7 +7667,7 @@ It MUST NOT be stored adjacent to a `provider-metadata.json`.
 
 The file `aggregator.json` SHOULD only list the latest version of the metadata of a CSAF provider.
 
-*Example 1:*
+*Example 1:*
 
 ```
   {
@@ -7348,7 +7723,7 @@ Each such folder MUST at least:
 * provide a `provider-metadata.json` for the current issuing party.
 * provide the ROLIE feed document according to requirement 15 which links to the local copy of the CSAF document.
 
-*Example 1:*
+*Example 1:*
 
 ```
   {
@@ -7622,6 +7997,7 @@ This document defines requirements for the CSAF file format and for certain soft
 The entities ("conformance targets") for which this document defines requirements are:
 
 * **CSAF document**: A security advisory text document in the format defined by this document.
+* **CSAF downloader**: A program that retrieves CSAF documents in an automated fashion.
 * **CSAF producer**: A program which emits output in the CSAF format.
 * **CSAF direct producer**: An analysis tool which acts as a CSAF producer.
 * **CSAF converter**: A CSAF producer that transforms the output of an analysis tool from its native output format into the CSAF format.
@@ -7655,6 +8031,7 @@ The entities ("conformance targets") for which this document defines requirement
 
 A text file or data stream satisfies the "CSAF document" conformance profile if it:
 
+* conforms to the syntax and semantics defined in section [2.2](#date-and-time)
 * conforms to the syntax and semantics defined in section [3](#schema-elements).
 * satisfies at least one profile defined in section [4](#profiles).
 * does not fail any mandatory test defined in section [6.1](#mandatory-tests).
@@ -7739,10 +8116,26 @@ Secondly, the program fulfills the following for all items of:
   * If a `vuln:CWE` instance refers to a CWE category or view, the CVRF CSAF converter MUST omit this instance and output a
     warning that this CWE has been removed as its usage is not allowed in vulnerability mappings.
 * `/vulnerabilities[]/ids`: If a `vuln:ID` element is given, the CVRF CSAF converter converts it into the first item of the `ids` array.
-* `/vulnerabilities[]/remediation[]`: If no `product_ids` or `group_ids` is given,
-  the CVRF CSAF converter appends all Product IDs which are listed under `../product_status` in the arrays `known_affected`,
-  `first_affected` and `last_affected` into `product_ids`.
-  If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
+* `/vulnerabilities[]/remediations[]`:
+  * If neither `product_ids` nor `group_ids` are given, the CVRF CSAF converter appends all Product IDs which are listed under
+    `../product_status` in the arrays `known_affected`, `first_affected` and `last_affected` into `product_ids`.
+    If none of these arrays exist, the CVRF CSAF converter outputs an error that no matching Product ID was found for this remediation element.
+  * The CVRF CSAF converter MUST convert any remediation with the type `Vendor Fix` into the category `optional_patch` if the product in
+    question is in one of the product status groups "Not Affected" or "Fixed" for this vulnerability.
+    Otherwise, the category `vendor_fix` MUST be set.
+    If multiple products are associated with the remediation - either directly or through a product group - and the products belong to
+    different product status groups, the CVRF CSAF converter MUST duplicate the remediation, change the category in one instance
+    to `optional_patch` and distribute the products accordingly as stated by the conversion rule.
+  * The CVRF CSAF converter MUST convert any remediation with the type `None Available` into the category `fix_planned`
+    if the product in question is also listed in a remediation of the type `Vendor Fix` with a `Date` in the future or no `Date` at all.
+    Consequently, the product MUST be removed from the remediation of the category `vendor_fix`.
+    If it was the last product in that remediation, the remediation MUST be removed.
+  * The CVRF CSAF converter MUST remove any product from a remediation with the type `None Available`
+    if the product in question is also listed in a remediation of the type `Vendor Fix` with a `Date` in the past or to the exact same time.
+    If it was the last product in that remediation, the remediation MUST be removed.
+  * In any other case, the CVRF CSAF converter MUST preserve the product in the remediation of the category `none_available`.
+  * The CVRF CSAF converter MUST output a warning if a remediation was added, deleted or the value of the category was changed,
+    including the products it was changed for.
 * `/vulnerabilities[]/metrics[]`:
   * For any CVSS v4 element, the CVRF CSAF converter MUST compute the `baseSeverity` from the `baseScore` according to
     the rules of the applicable CVSS standard. (CSAF CVRF v1.2 predates CVSS v4.0.)
@@ -7760,7 +8153,7 @@ Secondly, the program fulfills the following for all items of:
     the CVRF CSAF converter uses the following steps:
     1. Retrieve the CVSS version from the CVSS vector, if present.
 
-        *Example 1:*
+        *Example 1:*
 
         ```
           CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H => 3.1
@@ -7769,7 +8162,7 @@ Secondly, the program fulfills the following for all items of:
     2. Retrieve the CVSS version from the CVSS element's namespace, if present.
        The CVRF CSAF converter outputs a warning that this value was guessed from the element's namespace.
 
-        *Example 2:*
+        *Example 2:*
 
         ```
           xmlns:cvssv31="https://www.first.org/cvss/cvss-v3.1.xsd"
@@ -7779,7 +8172,7 @@ Secondly, the program fulfills the following for all items of:
 
         is handled the same as
 
-        *Example 3:*
+        *Example 3:*
 
         ```
           
@@ -7790,7 +8183,7 @@ Secondly, the program fulfills the following for all items of:
        If more than one CVSS namespace is present and the element is not clearly defined via the namespace,
        this step MUST be skipped without a decision.
 
-        *Example 4:*
+        *Example 4:*
 
         ```
           xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" => 3.0
@@ -8129,7 +8522,7 @@ Secondly, the program fulfills the following for all items of:
   option to use this label instead. If the TLP label changes through such conversion in a way that is not reflected in the table above, the
   the CSAF 2.0 to CSAF 2.1 converter MUST output a warning that the TLP label was taken from the distribution text. Such a warning MUST include
   both values: the converted one based on the table and the one from the distribution text.
-  > This is a common case for CSAF 2.0 documents labeled as TLP:RED but actually intended to be TLP:AMBER+STRICT.
+  > This is a common case for CSAF 2.0 documents labeled as `TLP:RED` but actually intended to be `TLP:AMBER+STRICT`.
 
   If no TLP label was given, the CSAF 2.0 to CSAF 2.1 converter SHOULD assign `TLP:CLEAR` and output a warning that the default TLP has been set.
 * `/document/publisher/category`: If the value is `other`, the CSAF 2.0 to CSAF 2.1 converter SHOULD output a warning that some parties have
@@ -8145,6 +8538,24 @@ Secondly, the program fulfills the following for all items of:
 
   The tool SHOULD implement an option to use the latest available CWE version at the time of the conversion that still matches.
 
+* `/vulnerabilities[]/remediations[]`:
+  * The CSAF 2.0 to CSAF 2.1 converter MUST convert any remediation with the category `vendor_fix` into the category `optional_patch`
+    if the product in question is in one of the product status groups "Not Affected" or "Fixed" for this vulnerability.
+    Otherwise, the category `vendor_fix` MUST stay the same.
+    If multiple products are associated with the remediation - either directly or through a product group - and the products belong to different
+    product status groups, the CSAF 2.0 to CSAF 2.1 converter MUST duplicate the remediation, change the category in one instance to `optional_patch`
+    and distribute the products accordingly as stated by the conversion rule.
+  * The CSAF 2.0 to CSAF 2.1 converter MUST convert any remediation with the category `none_available` into the category `fix_planned`
+    if the product in question is also listed in a remediation of the category `vendor_fix` with a `date` in the future or no `date` at all.
+    Consequently, the product MUST be removed from the remediation of the category `vendor_fix`.
+    If it was the last product in that remediation, the remediation MUST be removed.
+  * The CSAF 2.0 to CSAF 2.1 converter MUST remove any product from a remediation with the category `none_available`
+    if the product in question is also listed in a remediation of the category `vendor_fix` with a `date` in the past or to the exact same time.
+    If it was the last product in that remediation, the remediation MUST be removed.
+  * In any other case, the CSAF 2.0 to CSAF 2.1 converter MUST preserve the product in the remediation of the category `none_available`.
+  * The CSAF 2.0 to CSAF 2.1 converter MUST output a warning if a remediation was added, deleted or the value of the category was changed,
+    including the products it was changed for.
+
 > A tool MAY implement options to convert other Markdown formats to GitHub-flavored Markdown.
 
 > A tool MAY implement an additional, non-default option to output an invalid document that can be fixed afterwards. Solely in this case, any
@@ -8222,6 +8633,17 @@ A CSAF library satisfies the "CSAF library with extended validation" conformance
 A CSAF library does not satisfies the "CSAF library with full validation" conformance profile if the CSAF library uses an external library or
 program for the "CSAF full validator" part and does not enforce its presence.
 
+### 9.1.23 Conformance Clause 23: CSAF downloader 
+
+A program satisfies the "CSAF downloader" conformance profile if the program:
+
+* conforms to the process defined in section [7.3](#retrieving-rules) by executing all parts that are applicable to the given role.
+* supports directory-based and ROLIE-based retrieval.
+* is able to execute both steps from section [7.3](#retrieving-rules) separately.
+* uses a program-specific HTTP User Agent, e.g. consisting of the name and version of the program.
+
+> A tool MAY implement an option to store CSAF documents that fail any of the steps in section [7.3.2](#retrieving-csaf-documents).
+
 -------
 
 # Appendix A. Acknowledgments 
@@ -8362,6 +8784,8 @@ The following individuals were members of the OASIS CSAF Technical Committee dur
 | csaf-v2.0-wd20240626-dev | 2024-06-26 | Stefan Hagen and Thomas Schmidt | Next Editor Revision |
 | csaf-v2.0-wd20240731-dev | 2024-07-31 | Stefan Hagen and Thomas Schmidt | Next Editor Revision |
 | csaf-v2.0-wd20240828-dev | 2024-08-28 | Stefan Hagen and Thomas Schmidt | Next Editor Revision |
+| csaf-v2.0-wd20241030-dev | 2024-10-30 | Stefan Hagen and Thomas Schmidt | Next Editor Revision |
+
 -------
 
 # Appendix C. Guidance on the Size of CSAF Documents