SBOM Generation

In response to EO 14028 many organizations, both public and private sector, require software producers to generate Software Bill of Materials (SBOMs) to improve supply chain risk management. To comply with these obligations, you can generate SBOMs automatically using FOSSA.

These documents not only disclose open source component usage and their associated metadata but are useful for a number of events:

1. Security vulnerability reviews and VDR(Vulnerability Disclosure Report)/VEX(Vulnerability Exploitability eXchange) communication
2. Customer-facing Bill-of-Materials for sales enablement, partnerships or OEMs
3. Fully-compliant attribution and copyright notices
4. End of X (Life, Support, Maintenance) communication

To see an example live of how one of our customers uses FOSSA's reports, check out CNCF's Public SBOM Portal.

Software Bill of Material (SBOM) Generation via CLI

The FOSSA CLI, as of v3.1.5, is also capable of generating SBOM reports. This can be useful if you want to automate report generation in your CI pipeline. The FOSSA CLI currently supports four different formats: JSON, SPDX, markdown, and text. In order to generate a report in the FOSSA CLI you will need to run an additional report command after analyzing your project. The flags json, spdx, markdown, or text control the output format. Example:

export FOSSA_API_KEY=XXXXXXXX
fossa analyze && fossa report attribution --format spdx

Example truncated SPDX report from the FOSSA CLI:

Generating Software Bill of Materials (SBOMs) via UI

Visit a project or release group page and navigate to the Reports > SBOM tab to get to the SBOM Generation Tool:

On this page, you can choose which SBOM specification (cycloneDX or spdx) as well as your desired format (json , xml, tag-value) and preview what your SBOM will look like.

Embedding VDR & VEX statements:

FOSSA can help you automatically generate VDR and VEX statements within your SBOMs based on the security issue status for a given project or release group.

Selecting vulnerabilities within the applicable SBOM format will embed a VDR & VEX statement. Doing so adds a vulnerabilites array to your supported SBOM format.

All active security issues will be embedded with their CVE metadata (VDR) and an analysis (VEX) affirming the state is affected.

All ignored security issues will be embedded with their CVE metadata (VDR) and an analysis (VEX) affirming the state is not_affected , and an applicable justification. The justification is based on the CISA compliant VEX justifications . Pease see the below table of security ignore reasons and CISA VEX justification mappings:

Example VDR & VEX statement

"vulnerabilities": [
    {
      "bom-ref": "CVE-2023-39956",
      "id": "CVE-2023-39956",
      "source": {
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39956",
        "name": "NVD"
      },
      "ratings": [
        {
          "source": {
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39956",
            "name": "NVD"
          },
          "score": 6.6,
          "severity": "medium",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
          "method": "CVSSv31"
        }
      ],
      "cwes": [
        94
      ],
      "description": "Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted.   Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with an attacker-controlled working directory and 2. The attacker has the ability to write files to that working directory. This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance.  This issue has been fixed in versions:`26.0.0-beta.13`, `25.4.1`, `24.7.1`, `23.3.13`, and `22.3.19`. There are no app side workarounds, users must update to a patched version of Electron.",
      "recommendation": "Upgrade dependency electron from version 11.1.1 to 22.3.21 to mitigate this vulnerability, or to version 22.3.25 to mitigate all existing vulnerabilities.",
      "advisories": [
        {
          "url": "https://github.com/electron/electron/security/advisories/GHSA-7x97-j373-85x5"
        },
        {
          "url": "https://github.com/advisories/GHSA-7x97-j373-85x5"
        },
        {
          "url": "https://www.npmjs.com/package/electron"
        }
      ],
      "published": "2023-09-06T19:51:33.000Z",
      "affects": [
        {
          "ref": "pkg:npm/[email protected]",
          "versions": [
            {
              "version": "11.1.1",
              "status": "affected"
            }
          ]
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "Inline_mitigations_already_exist",
        "detail": "Dev Analysis: CVE not exploitable due to inline mitigation in the form of external input validation preventing injection"
      }
    },
    {
      "bom-ref": "CVE-2023-44402",
      "id": "CVE-2023-44402",
      "source": {
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44402",
        "name": "NVD"
      },
      "ratings": [
        {
          "source": {
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44402",
            "name": "NVD"
          },
          "score": 7,
          "severity": "high",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "method": "CVSSv31"
        }
      ],
      "cwes": [
        345
      ],
      "description": "Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled.  Apps without these fuses enabled are not impacted.  This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too.  i.e. the ability to edit files inside the `.app` bundle on macOS which these fuses are supposed to protect against. There are no app side workarounds, you must update to a patched version of Electron.",
      "recommendation": "Upgrade dependency electron from version 11.1.1 to 22.3.24 to mitigate this vulnerability, or to version 22.3.25 to mitigate all existing vulnerabilities.",
      "advisories": [
        {
          "url": "https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85"
        },
        {
          "url": "https://github.com/advisories/GHSA-7m48-wc93-9g85"
        },
        {
          "url": "https://www.npmjs.com/package/electron"
        },
        {
          "url": "https://github.com/electron/electron/pull/39788"
        },
        {
          "url": "https://www.electronjs.org/docs/latest/tutorial/fuses"
        }
      ],
      "published": "2023-12-01T21:32:06.000Z",
      "affects": [
        {
          "ref": "pkg:npm/[email protected]",
          "versions": [
            {
              "version": "11.1.1",
              "status": "affected"
            }
          ]
        }
      ],
      "analysis": {
        "state": "affected"
      }
    },
    {
      "bom-ref": "CVE-2023-29198",
      "id": "CVE-2023-29198",
      "source": {
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29198",
        "name": "NVD"
      },
      "ratings": [
        {
          "source": {
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29198",
            "name": "NVD"
          },
          "score": 8.5,
          "severity": "high",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "method": "CVSSv31"
        }
      ],
      "cwes": [
        754
      ],
      "description": "Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps using `contextIsolation` and `contextBridge` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. This issue is only exploitable if an API exposed to the main world via `contextBridge` can return an object or array that contains a javascript object which cannot be serialized, for instance, a canvas rendering context. This would normally result in an exception being thrown `Error: object could not be cloned`. The app side workaround is to ensure that such a case is not possible. Ensure all values returned from a function exposed over the context bridge are supported. This issue has been fixed in versions `25.0.0-alpha.2`, `24.0.1`, `23.2.3`, and `22.3.6`.",
      "recommendation": "Upgrade dependency electron from version 11.1.1 to 22.3.6 to mitigate this vulnerability, or to version 22.3.25 to mitigate all existing vulnerabilities.",
      "advisories": [
        {
          "url": "https://github.com/electron/electron/security/advisories/GHSA-p7v2-p9m8-qqg7"
        },
        {
          "url": "https://github.com/advisories/GHSA-p7v2-p9m8-qqg7"
        },
        {
          "url": "https://www.npmjs.com/package/electron"
        },
        {
          "url": "https://www.electronjs.org/docs/latest/api/context-bridge#parameter--error--return-type-support"
        }
      ],
      "published": "2023-09-06T19:50:58.000Z",
      "affects": [
        {
          "ref": "pkg:npm/[email protected]",
          "versions": [
            {
              "version": "11.1.1",
              "status": "affected"
            }
          ]
        }
      ],
      "analysis": {
        "state": "affected"
      }
    }

👍

Premium Feature

Business and Enterprise feature only. Please contact [email protected] for more details.

Customizing a Software Bill of Materials

Step 1: Select Your Reporting Format

FOSSA supports multiple SBOM formats: **CycloneDX-json, CycloneDX-xml, SPDX-tag-vaue, SPDX-json.

Step 2: Select the Components of Your Report

FOSSA offers the ability to customize the types of information displayed. Within the Reports tab you can decide whether you want to include.

Step 3: Select the Open Source Package Information to Include

FOSSA collects information about every open source component including information like the package authors, the package URL, and more. You can customize the information about each open source component by clicking edit dependency information. The following information is available:

📘

Note

Currently all direct and transitive dependencies are included in all SBOM formats

Step 4

Select Download or Email to download the SBOM or start the generation job to email the SBOM depending on the dependency count and size.

For more questions please contact [email protected]