vexctl merge produced two contradictory statements for the same CVE in one document

Not specified by the original author.

TL;DR

vexctl merge concatenates statements; it does not adjudicate them. If your inputs contain an older not_affected and a newer affected for the same CVE and product, the merged document carries both, and consumers read a contradiction. Sort inputs by timestamp, ensure one statement per product-CVE pair with the latest winning, and re-merge. Then make the input pipeline stop producing contradictions in the first place.

The query

vexctl merge produced two contradictory statements for the same CVE in one document

Use this when

• A merged VEX document has two different statuses for one CVE
• The inputs came from different tools or different runs
• Consumers of the VEX data report conflicting verdicts

Not for

• Deciding which status is correct (that is analysis, not merging)
• VEX documents that fail to parse (a format problem)
• Single statements you disagree with (authoring decision)

Steps

1. Find the contradicting pair

Search the merged document for the CVE ID and list every statement touching it, with timestamps and statuses.

Expected output: the two (or more) statements, their sources, and their timestamps side by side.

2. Determine which statement is current

The newer timestamp normally wins, but verify: check whether the newer statement supersedes the older one or whether they describe different products.

Expected output: a verdict on which statement reflects current knowledge, or confirmation they are about different products (then both are fine).

3. Dedupe to one statement per product and CVE

Remove the superseded statement, keeping the current one with its justification. If they are about different products, keep both but confirm the product scoping is explicit.

Expected output: exactly one status per product-CVE pair.

4. Re-merge deterministically

Sort all input statements by timestamp before merging, and merge with a rule that the latest statement per product-CVE pair wins. Script this; do not rely on file order.

Expected output: a merged document with no contradictions, reproducible from the same inputs.

5. Fix the producer, not just the document

Find why two contradictory statements were generated: two tools with different verdicts, a stale cache, a rerun that did not invalidate the old output. Verify: the next merge inputs contain no contradictions before merging.

Variant phrasings

vexctl merge contradictory statements same CVE

The short symptom search.

vex merge two statuses one CVE document

The tool-agnostic search.

Compatibility: vexctl and VEX documents in CycloneDX or CSAF VEX profiles. The one-status-per-product rule is part of the VEX model.

Why it happens

Merging is a mechanical operation: combine statements from multiple sources into one document. Adjudication (deciding which of two conflicting statements is right) is a judgment operation. vexctl does the first and not the second, so contradictions in the inputs become contradictions in the output. The tool is not broken; the expectation that merging resolves conflicts is.

Edge cases / pitfalls

• Timestamps can lie if the producers' clocks disagree. Prefer a sequence or revision marker from the producing system when timestamps are unreliable.
• A newer statement is not always the correct one; a bad rerun can overwrite a good manual verdict. Keep manual statements authoritative over automated ones, or at least flagged.
• Consumers that read only the first matching statement will silently pick a side. The contradiction must be fixed at the source, not documented around.
• Archive the superseded statements instead of deleting them outright. The audit trail of "we believed X, then learned Y" is valuable.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstYm3ANkcCYm-NNuGzz_s9Q

Resolved from the public thread: https://vectle.com/posts/pstYm3ANkcCYm-NNuGzz_s9Q

Thread query: vexctl merge produced two contradictory statements for the same CVE in one document

TL;DR: vexctl merge concatenates statements; it does not adjudicate them. If your inputs contain an older not_affected and a newer affected for the same CVE and product, the merged document carries both, and consumers read a contradiction. Sort inputs by timestamp, ensure one statement per product-CVE pair with the latest winning, and re-merge. Then make the input pipeline stop producing contradictions in the first place.