← Years 9–10 Digital Systems

Software bill of materials (SBOM)

A software bill of materials: a list of every component and library inside a piece of software, with version numbers, so owners can check each one for known vulnerabilities.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 69, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 69

Understanding Software bill of materials (SBOM) in Years 9–10 Digital Systems

What it does: Searching the SBOM for the component named in the CVE quickly shows which products contain it, without opening every product. The version number is what lets owners compare a component with the CVE's affected versions and decide if an update is needed. Version 3.5 is not below 3.2, so it is outside the affected range. Always check the CVE details to be sure. Vulnerabilities often hide in third-party libraries. An SBOM must list all components, not just your own code. SBOM is short for software bill of materials. It works like an ingredients list for an app, so owners know what is inside it.

Common mistakes: Each SBOM entry needs the component's version number as well as its name, or owners can't tell if it is affected by a CVE. It should be ("libpng", "1.6.37"). The loop must go through the components listed in the SBOM, not the CVE package name. It should be: for name, ver in sbom:.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Software bill of materials (SBOM) to a class →

This module's key terms are also in a printable crossword (Modules 41–69) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

What is a software bill of materials (SBOM)?

A receipt showing how much a person paid for the softwareA list of every component and library inside a piece of software

Matches

{"name": "openssl"}

↓

The SBOM entry has no version number, so you cannot tell if this component is affected by a CVE

Applying

Meanings

Term

SBOM

Meaning

A software bill of materials: a list of every component and library inside a piece of software, with version numbers, so owners can check each one for known vulnerabilities.

Practice

SBOM for PhotoShare app v2.1

Testing

Gaps

: 2.14.0

Check Answer

Spots

1sbom = [

2 ("libpng"),

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What is a software bill of materials (SBOM)?

A. A list of every component and library inside a piece of software ✓

B. A receipt showing how much a person paid for the software

An SBOM works like an ingredients list for software. It names each component so owners know what is inside.

2. Why do owners keep an SBOM for their software?

A. To make the software run faster

B. To check each component for known vulnerabilities ✓

The SBOM does not speed anything up. It lets owners look up each listed component to see if it has a known security problem.

3. A new CVE is announced for a library called 'imagetool'. How does an SBOM help?

A. Search the SBOMs to find which products contain imagetool ✓

B. Wait for the software to crash, then investigate

With SBOMs on hand, owners can quickly search for the affected library and find every product that needs fixing, instead of guessing.

4. Which entry is more useful in an SBOM?

A. logcore

B. logcore version 2.14.0 ✓

Version numbers matter because a flaw usually affects only certain versions. Without the version you cannot tell if you are affected.

5. A CVE says it affects 'versions below 3.2'. Your SBOM lists the component at version 3.5. What does this suggest?

A. This component is probably not affected ✓

B. This component is definitely affected

Version 3.5 is not below 3.2, so it is outside the affected range. Always check the CVE details to be sure.

Match the Pairs

SBOM → A software bill of materials: a list of every component and library inside a piece of software

"name": "log4j-core", "version": "2.14.1" → An SBOM entry that records a component and its exact version number

When a CVE is announced, search your SBOMs for the affected component to find which products need fixing → grep "log4j-core" sbom.json

Version numbers in an SBOM show whether a component is a vulnerable version or a patched one → "version": "2.17.1"

{"name": "openssl"} → The SBOM entry has no version number, so you cannot tell if this component is affected by a CVE

SBOM lists only: MyApp 1.0 → The SBOM lists only the main app and leaves out the libraries and components inside it

Key Term

SBOM

A software bill of materials: a list of every component and library inside a piece of software, with version numbers, so owners can check each one for known vulnerabilities.

Fill in the Blanks

1. name: logtool version: 2.14.0

Hint: Type the field name that records which release of the component is used.

2. CVE-2021-44228 affects logtool 2.14.0

Hint: Type the three-letter acronym for the ID given to a publicly announced vulnerability.

3. FOR EACH product IN products IF product.sbom CONTAINS "logtool 2.14.0" SEND alert

Hint: Type the keyword that checks whether a list includes a certain component.

4. IF version < "2.17.0" status = "vulnerable" ENDIF

Hint: Type the operator that checks if the installed version is older than the fixed version.

5. sbom = ["logtool 2.14.0", "webkit 5.3.1"] PRINT sbom

Hint: Type the variable name for the list of components and versions.

Spot the Error

Question 1

A sbom = [

B ("libpng"),

C ("zlib", "1.2.11"),

D ]

Line B — Each SBOM entry needs the component's version number as well as its name, or owners can't tell if it is affected by a CVE. It should be ("libpng", "1.6.37").

Question 2

A cve_package = "zlib"

B cve_version = "1.2.11"

C for name, ver in cve_package:

D if name == cve_package:

E print("Affected", name)

Line C — The loop must go through the components listed in the SBOM, not the CVE package name. It should be: for name, ver in sbom:

Question 3

A sbom = load("app_sbom.txt")

B cve_name = "log4j"

C names = sbom.names()

D found = cve_name not in names

E print(found)

Line D — This reverses the check. found would be True when the library is NOT in the SBOM. It should be: found = cve_name in names

Question 4

A installed = "2.14.1"

B fixed = 2.17.0

C if is_older(installed, fixed):

D print("Update needed")

Line B — A version number with several dots is not a valid number, so it must be written as text in quotes. It should be: fixed = "2.17.0"

Question 5

A sbom = {

B "openssl": "3.0.1",

C "curl": "7.81.0",

D "zlib" = "1.2.11"

E }

Line D — Inside a dictionary, each component name is linked to its version with a colon, not an equals sign. It should be: "zlib": "1.2.11"

Student with a class code? Join your class →