AWS inspector documentation change
Summary
Expanded SBOM generator documentation to add support for Nginx, OpenSSH, OpenSSL, and Oracle Database Server ecosystems. Updated collection methods, version extraction details, and example PURLs for multiple components. Reorganized ecosystem listings and added platform-specific binary analysis techniques.
Security assessment
The changes enhance documentation about component version tracking for security-critical software like OpenSSH and OpenSSL, which helps identify vulnerable versions. However, there is no explicit mention of addressing a specific security vulnerability or incident. The updates primarily improve SBOM capabilities for security posture management.
Diff
diff --git a/inspector/latest/user/sbom-generator-ecosystem-collection.md b/inspector/latest/user/sbom-generator-ecosystem-collection.md index c3ea66b1a..87ed82bb8 100644 --- a//inspector/latest/user/sbom-generator-ecosystem-collection.md +++ b//inspector/latest/user/sbom-generator-ecosystem-collection.md @@ -5 +5 @@ -Supported ecosystemsApache ecosystem collectionJava ecosystem collectionGoogle ecosystem collectionWordPress ecosystem collectionNode.JS runtime collectionOpenSSL Ecosystem Collection +Supported ecosystemsApache ecosystem collectionGoogle ecosystem collectionJava ecosystem collectionNginx ecosystem collectionNode.JS runtime collectionOpenSSH collectionOpenSSL ecosystem CollectionOracle Database Server collectionWordPress ecosystem collection @@ -17 +16,0 @@ Ecosystems | Applications -Oracle Java | JDK JRE Amazon Corretto @@ -19 +17,0 @@ Apache | httpd tomcat -WordPress | core plugin theme @@ -20,0 +19,7 @@ Google | Chrome +Java | JDK JRE Amazon Corretto +Nginx | Nginx +Node | Node +OpenSSH | OpenSSH (Versions 9 and 10) +OpenSSL | OpenSSL +Oracle | Oracle Database Server +WordPress | core plugin theme @@ -100,0 +106,64 @@ The following is an example package URL for an `Apache Tomcat` application. +## Google ecosystem collection + +###### Supported application + + * Google Chrome + + + + +###### Supported artifacts + +Amazon Inspector collects Google Chrome information from the following: + + * The `chrome/VERSION` file (build source) + + * The `puppeteer` file (installation) + + + + +The Amazon Inspector SBOM Generator parses and collects corresponding versions of each of the supported artifacts. + +###### Example `chrome/VERSION` version file + +The following is an example of the `chrome/VERSION` version file. + + + MAJOR=130 + MINOR=0 + BUILD=6723 + PATCH=58 + + +###### Example PURL + +The following is an example package URL for a `chrome/VERSION` version file. + + + Sample PURL: pkg:generic/google/[email protected] + +###### Example `puppeteer` version file + +The following is an example of the `puppeteer` version file. + + + { + "name": "puppeteer", + "version": "23.9.0", + "description": "A high-level API to control headless Chrome over the DevTools Protocol", + "keywords": [ + "puppeteer", + "chrome", + "headless", + "automation" + ] + } + +###### Example PURL + +The following is an example package URL for a `puppeteer` version file. + + + Sample PURL: pkg:generic/google/[email protected] + @@ -180 +249 @@ The following is an example package URL for an Oracle Java release. -## Google ecosystem collection +## Nginx ecosystem collection @@ -182 +251,24 @@ The following is an example package URL for an Oracle Java release. -###### Supported application +###### Supported applications + + * Nginx + + + + +###### Supported platforms + +The following are supported platforms. + +###### Linux + + * /usr/sbin/nginx + + * /usr/local/nginx + + * /usr/local/etc/nginx + + * /usr/local/nginx/nginx + + * /usr/local/nginx/sbin/nginx + + * /etc/nginx/nginx @@ -184 +276,44 @@ The following is an example package URL for an Oracle Java release. - * Google Chrome + + + +###### Windows + + * C:\nginx\nginx.exe + + * C:\nginx-x.y.z\nginx.exe (x.y.z is an arbitrary version) + + + + +###### MacOS + + * /usr/local/etc/nginx/nginx + + + + +###### Key features + +This collection examines binaries to extract embedded version information. It searches for version strings in the binary executable `.rodata` section (for ELF binaries on Linux), `.rdata` section (for PE binaries on Windows), or `__ctring` section (for MachO binaries). + +###### Example version string + +The following is an example of a version string embedded in an Nginx binary. + + + nginx version: nginx/1.27.5 + +Version `1.27.5` is extracted to identify the Nginx version. + +###### Example PURL + +The following is an example package URL for Nginx. + + + Sample PURL: pkg:generic/nginx/[email protected] + +## Node.JS runtime collection + +###### Supported applications + + * node runtime binary for Node.JS @@ -191 +326 @@ The following is an example package URL for an Oracle Java release. -Amazon Inspector collects Google Chrome information from the following: + * MacOS and Linux – `node` binary detection through binary details installed with `asdf`, `fnm`, `nvm`, `volta`, or official Node.JS containers. @@ -193 +327,0 @@ Amazon Inspector collects Google Chrome information from the following: - * The `chrome/VERSION` file (build source) @@ -195 +328,0 @@ Amazon Inspector collects Google Chrome information from the following: - * The `puppeteer` file (installation) @@ -197,0 +331 @@ Amazon Inspector collects Google Chrome information from the following: +###### Example MacOS and Linux paths @@ -198,0 +333 @@ Amazon Inspector collects Google Chrome information from the following: +The following is an example of paths for MacOS and Linux. @@ -200 +334,0 @@ Amazon Inspector collects Google Chrome information from the following: -The Amazon Inspector SBOM Generator parses and collects corresponding versions of each of the supported artifacts. @@ -202 +336,5 @@ The Amazon Inspector SBOM Generator parses and collects corresponding versions o -###### Example `chrome/VERSION` version file + NVM: ~/.nvm/, /usr/local/nvm + FNM: ~/.local/share/fnm/ + ASDF: ~/.asdf/ + MISE: ~/.local/share/mise/ + VOLTA: ~/.volta/ @@ -204 +341,0 @@ The Amazon Inspector SBOM Generator parses and collects corresponding versions o -The following is an example of the `chrome/VERSION` version file. @@ -205,0 +343,46 @@ The following is an example of the `chrome/VERSION` version file. +###### Example PURL + +The following is an example package URL for Node.JS. + + + Sample PURL: pkg:generic/nodejs/[email protected] + + +## OpenSSH collection + +###### Supported applications + + * OpenSSH (Version 9) + + * OpenSSH (Version 10) + + +