Software bill of materials (SBOM)

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What is a software bill of materials (SBOM)?

A A list of every component and library inside a piece of software

B A receipt showing how much a person paid for the software

2. Why do owners keep an SBOM for their software?

A To make the software run faster

B To check each component for known vulnerabilities

3. A new CVE is announced for a library called 'imagetool'. How does an SBOM help?

A Search the SBOMs to find which products contain imagetool

B Wait for the software to crash, then investigate

4. Which entry is more useful in an SBOM?

A logcore

B logcore version 2.14.0

5. A CVE says it affects 'versions below 3.2'. Your SBOM lists the component at version 3.5. What does this suggest?

A This component is probably not affected

B This component is definitely affected

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1SBOM		AA software bill of materials: a list of every component and library inside a piece of software
2"name": "log4j-core", "version": "2.14.1"		BThe SBOM lists only the main app and leaves out the libraries and components inside it
3When a CVE is announced, search your SBOMs for the affected component to find which products need fixing		Cgrep "log4j-core" sbom.json
4Version numbers in an SBOM show whether a component is a vulnerable version or a patched one		D"version": "2.17.1"
5{"name": "openssl"}		EAn SBOM entry that records a component and its exact version number
6SBOM lists only: MyApp 1.0		FThe SBOM entry has no version number, so you cannot tell if this component is affected by a CVE

Definitions

SBOM

Fill in the Blanks

Complete each line of code by filling in the missing parts.

name: logtool _______: 2.14.0

___-2021-44228 affects logtool 2.14.0

FOR EACH product IN products IF product.sbom ________ "logtool 2.14.0" SEND alert

IF version _ "2.17.0" status = "vulnerable" ENDIF

____ = ["logtool 2.14.0", "webkit 5.3.1"] PRINT sbom

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A sbom = [

B ("libpng"),

C ("zlib", "1.2.11"),

D ]

Question 2

A cve_package = "zlib"

B cve_version = "1.2.11"

C for name, ver in cve_package:

D if name == cve_package:

E print("Affected", name)

Question 3

A sbom = load("app_sbom.txt")

B cve_name = "log4j"

C names = sbom.names()

D found = cve_name not in names

E print(found)

Question 4

A installed = "2.14.1"

B fixed = 2.17.0

C if is_older(installed, fixed):

D print("Update needed")

Question 5

A sbom = {

B "openssl": "3.0.1",

C "curl": "7.81.0",

D "zlib" = "1.2.11"

E }

Answer Key

Software bill of materials (SBOM)

Section A: Quick Questions

A — A list of every component and library inside a piece of software

B — To check each component for known vulnerabilities

A — Search the SBOMs to find which products contain imagetool

B — logcore version 2.14.0

A — This component is probably not affected

Section B: Match the Pairs

SBOM → A software bill of materials: a list of every component and library inside a piece of software

"name": "log4j-core", "version": "2.14.1" → An SBOM entry that records a component and its exact version number

When a CVE is announced, search your SBOMs for the affected component to find which products need fixing → grep "log4j-core" sbom.json

Version numbers in an SBOM show whether a component is a vulnerable version or a patched one → "version": "2.17.1"

{"name": "openssl"} → The SBOM entry has no version number, so you cannot tell if this component is affected by a CVE

SBOM lists only: MyApp 1.0 → The SBOM lists only the main app and leaves out the libraries and components inside it

Section C: Definitions

SBOM — A software bill of materials: a list of every component and library inside a piece of software, with version numbers, so owners can check each one for known vulnerabilities.

Section D: Fill in the Blanks

name: logtool
version: 2.14.0

CVE-2021-44228 affects logtool 2.14.0

FOR EACH product IN products
  IF product.sbom CONTAINS "logtool 2.14.0"
    SEND alert

IF version < "2.17.0"
  status = "vulnerable"
ENDIF

sbom = ["logtool 2.14.0", "webkit 5.3.1"]
PRINT sbom

Section E: Spot the Error

B — Each SBOM entry needs the component's version number as well as its name, or owners can't tell if it is affected by a CVE. It should be ("libpng", "1.6.37").

C — The loop must go through the components listed in the SBOM, not the CVE package name. It should be: for name, ver in sbom:

D — This reverses the check. found would be True when the library is NOT in the SBOM. It should be: found = cve_name in names

B — A version number with several dots is not a valid number, so it must be written as text in quotes. It should be: fixed = "2.17.0"

D — Inside a dictionary, each component name is linked to its version with a colon, not an equals sign. It should be: "zlib": "1.2.11"