AWS inspector documentation change
Summary
Added OpenSSL Ecosystem Collection support to SBOM Generator for version 3.0.0+ installations
Security assessment
Enhances SBOM capabilities to track OpenSSL versions, which helps identify potential vulnerabilities but doesn't fix a specific security issue.
Diff
diff --git a/inspector/latest/user/sbom-generator-ecosystem-collection.md b/inspector/latest/user/sbom-generator-ecosystem-collection.md index 82a22c2b4..9b803410e 100644 --- a//inspector/latest/user/sbom-generator-ecosystem-collection.md +++ b//inspector/latest/user/sbom-generator-ecosystem-collection.md @@ -5 +5 @@ -Supported ecosystemsApache ecosystem collectionJava ecosystem collectionGoogle ecosystem collectionWordPress ecosystem collectionNode.JS runtime collection +Supported ecosystemsApache ecosystem collectionJava ecosystem collectionGoogle ecosystem collectionWordPress ecosystem collectionNode.JS runtime collectionOpenSSL Ecosystem Collection @@ -388,0 +389,44 @@ The following is an example package URL for Node.JS. +## OpenSSL Ecosystem Collection + +###### Supported applications + +Support for OpenSSL libraries and development packages is limited to software built with official OpenSSL for 3.0.0 releases and above. The software also must follow semantic versioning. Custom or forked OpenSSL variants and versions lower than 3.0.0 are not supported. + +The Amazon Inspector SBOM Generator extracts key package information for each installed OpenSSL instance. + +###### Key features + + * Extracts the base SEMVER version string from the OpenSSL header file + + * Identifies the directory path containing the OpenSSL installation + + + + +The Amazon Inspector SBOM Generator looks for OpenSSL installations by scanning for the `opensslv.h` file in common installation paths across platforms. + +###### Example installation path for Linux/Unix + +The following is an example installation path for Linux/Unix. + + + /usr/local/include/openssl/opensslv.h + /usr/local/ssl/include/openssl/opensslv.h + /usr/local/openssl/include/openssl/opensslv.h + /usr/local/opt/openssl/include/openssl/opensslv.h + /usr/include/openssl/opensslv.h + +The Amazon Inspector SBOM Generator extracts version information by parsing the `opensslv.h` file and looking for the version definitions. + + + # define OPENSSL_VERSION_MAJOR 3 + # define OPENSSL_VERSION_MINOR 4 + # define OPENSSL_VERSION_PATCH 0 + +###### Example PURL + +The following is an example package URL for the OpenSSL version. + + + Sample PURL: pkg:generic/openssl/[email protected] +