Supported ecosystems Apache ecosystem collection Google ecosystem collection Java ecosystem collection Nginx ecosystem collection Node.JS runtime collection OpenSSH collection OpenSSL ecosystem Collection Oracle Database Server collection WordPress ecosystem collection

Amazon Inspector SBOM Generator comprehensive ecosystem collection

The Amazon Inspector SBOM Generator is a tool for creating a software bill of materials (SBOM) and performing vulnerability scanning for supported packages from operating systems and programming languages. It also supports the scanning of various ecosystems beyond core operating systems, ensuring a robust and detailed analysis of infrastructure components. By generating an SBOM, users can understand the composition of their modern technology stacks, identify vulnerabilities in ecosystem components, and gain visibility into third party software.

Supported ecosystems

The ecosystem collection extends SBOM generation beyond packages installed through OS package managers. This is done through the collection of applications deployed in alternative methods, such as manual installation. The Amazon Inspector SBOM Generator supports scanning for the following ecosystems:

Ecosystems	Applications
Apache	httpd tomcat
Google	Chrome
Java	JDK JRE Amazon Corretto
Nginx	Nginx
Node	Node
OpenSSH	OpenSSH (Versions 9 and 10)
OpenSSL	OpenSSL
Oracle	Oracle Database Server
WordPress	core plugin theme
Node.JS	node

Apache ecosystem collection

The Amazon Inspector SBOM Generator scans for Apache installations that are in common installation paths across platforms:

macOS: /Library/
Linux: /etc/, /usr/share, /usr/lib, /usr/local, /var, /opt

Supported applications

httpd
tomcat

Key features

Apache httpd – Parses the /include/ap_release.h file to extract installation macros, which contain major identifier strings, minor identifier strings, and patch identifier strings.
Apache tomcat – Unpacks the catalina.jar file to extract installation macros inside of the (META-INF/MANIFEST.MF) file, which contains the version string.

Example `ap_release.h` file

The following is an example of the content inside of the ap_release.h file.



//truncated

#define AP_SERVER_BASEVENDOR "Apache Software Foundation"
#define AP_SERVER_BASEPROJECT "Apache HTTP Server"
#define AP_SERVER_BASEPRODUCT "Apache"

#define AP_SERVER_MAJORVERSION_NUMBER 2
#define AP_SERVER_MINORVERSION_NUMBER 4
#define AP_SERVER_PATCHLEVEL_NUMBER   1
#define AP_SERVER_DEVBUILD_BOOLEAN    0

//truncated

Example PURL

The following is an example package URL for an Apache httpd application.



Sample PURL: pkg:generic/apache/httpd@2.4.1

Example `catalina.jar/META-INF/MANIFEST.MF` file

The following is an example of the content inside of the catalina.jar/META-INF/MANIFEST.MF file.



//truncated

Implementation-Title: Apache Tomcat
Implementation-Vendor: Apache Software Foundation
Implementation-Version: 10.1.31

//truncated

Example PURL

The following is an example package URL for an Apache Tomcat application.



Sample PURL: pkg:generic/apache/tomcat@10.1.31

Google ecosystem collection

Supported application

Google Chrome
Puppeteer (supports the puppeteer library; puppeteer-core is not included)

Note

Puppeteer supports the puppeteer library. Puppeteer core is not included.

Supported artifacts

Amazon Inspector collects Google Chrome information from the following:

The chrome/VERSION file (build source)
The chrome.exe file (Windows Chrome installation)
The puppeteer file (installation)

For each of the supported artifacts, the Sbomgen parses and collects either chrome file or the puppeteer file. For puppeteer installations, the corresponding Chromium version is collected based on the puppeteer version. For more information, see Supported browsers on the Puppeteer website.

When the PUPPETEER_SKIP_CHROMIUM_DOWNLOAD environment variable is set to true, evaluation is skipped, and the skip_chromium_download=true qualifier is added to the Puppeteer package URL.

Example `chrome/VERSION` version file

The following is an example of the chrome/VERSION version file.



MAJOR=130
MINOR=0
BUILD=6723
PATCH=58

Example PURL

The following is an example package URL for a chrome/VERSION version file.


Sample PURL: pkg:generic/google/chrome@131.0.6778.87

Example `puppeteer` version file

The following is an example of the puppeteer version file.


{
"name": "puppeteer",
"version": "23.9.0",
"description": "A high-level API to control headless Chrome over the DevTools Protocol",
"keywords": [
  "puppeteer",
  "chrome",
  "headless",
  "automation"
]
}

Example PURL

The following is an example package URL for a puppeteer version file.


Sample PURL: pkg:generic/google/puppeteer@23.9.0

Example PURL

The following is an example package URL with skip qualifier for a puppeteer version file.


pkg:generic/google/puppeteer@22.15.0?distro=linux&skip_chromium_download=true

Java ecosystem collection

Supported applications

Oracle JDK
Oracle JRE
Amazon Corretto

Key features

Extracts the string of the Java installation.
Identifies the directory path that contains the Java runtime.
Identifies the vendor as Oracle JDK, Oracle JRE, and Amazon Corretto.

The Amazon Inspector SBOM Generator scans for Java installations across the following installation paths and platforms:

macOS: /Library/Java/JavaVirtualMachines
Linux 32-bit: /usr/lib/jvm
Linux 64-bit: /usr/lib64/jvm
Linux (generic): /usr/java and /opt/java

Example Java version information

The folllowing is an example of an Oracle Java release.



// Amazon Corretto
IMPLEMENTOR="Amazon.com Inc."
IMPLEMENTOR_VERSION="Corretto-17.0.11.9.1"
JAVA_RUNTIME_VERSION="17.0.11+9-LTS"
JAVA_VERSION="17.0.11"
JAVA_VERSION_DATE="2024-04-16"
LIBC="default"
MODULES="java.base java.compiler java.datatransfer java.xml java.prefs java.desktop java.instrument java.logging java.management java.security.sasl java.naming java.rmi java.management.rmi java.net.http java.scripting java.security.jgss java.transaction.xa java.sql java.sql.rowset java.xml.crypto java.se java.smartcardio jdk.accessibility jdk.internal.jvmstat jdk.attach jdk.charsets jdk.compiler jdk.crypto.ec jdk.crypto.cryptoki jdk.dynalink jdk.internal.ed jdk.editpad jdk.hotspot.agent jdk.httpserver jdk.incubator.foreign jdk.incubator.vector jdk.internal.le jdk.internal.opt jdk.internal.vm.ci jdk.internal.vm.compiler jdk.internal.vm.compiler.management jdk.jartool jdk.javadoc jdk.jcmd jdk.management jdk.management.agent jdk.jconsole jdk.jdeps jdk.jdwp.agent jdk.jdi jdk.jfr jdk.jlink jdk.jpackage jdk.jshell jdk.jsobject jdk.jstatd jdk.localedata jdk.management.jfr jdk.naming.dns jdk.naming.rmi jdk.net jdk.nio.mapmode jdk.random jdk.sctp jdk.security.auth jdk.security.jgss jdk.unsupported jdk.unsupported.desktop jdk.xml.dom jdk.zipfs"
OS_ARCH="x86_64"
OS_NAME="Darwin"
SOURCE=".:git:7917f11551e8+"

// JDK
IMPLEMENTOR="Oracle Corporation"
JAVA_VERSION="19"
JAVA_VERSION_DATE="2022-09-20"
LIBC="default"
MODULES="java.base java.compiler java.datatransfer java.xml java.prefs java.desktop java.instrument java.logging java.management java.security.sasl java.naming java.rmi java.management.rmi java.net.http java.scripting java.security.jgss java.transaction.xa java.sql java.sql.rowset java.xml.crypto java.se java.smartcardio jdk.accessibility jdk.internal.jvmstat jdk.attach jdk.charsets jdk.zipfs jdk.compiler jdk.crypto.ec jdk.crypto.cryptoki jdk.dynalink jdk.internal.ed jdk.editpad jdk.hotspot.agent jdk.httpserver jdk.incubator.concurrent jdk.incubator.vector jdk.internal.le jdk.internal.opt jdk.internal.vm.ci jdk.internal.vm.compiler jdk.internal.vm.compiler.management jdk.jartool jdk.javadoc jdk.jcmd jdk.management jdk.management.agent jdk.jconsole jdk.jdeps jdk.jdwp.agent jdk.jdi jdk.jfr jdk.jlink jdk.jpackage jdk.jshell jdk.jsobject jdk.jstatd jdk.localedata jdk.management.jfr jdk.naming.dns jdk.naming.rmi jdk.net jdk.nio.mapmode jdk.random jdk.sctp jdk.security.auth jdk.security.jgss jdk.unsupported jdk.unsupported.desktop jdk.xml.dom"
OS_ARCH="x86_64"
OS_NAME="Darwin"
SOURCE=".:git:53b4a11304b0 open:git:967a28c3d85f"

Example PURL

The following is an example package URL for an Oracle Java release.



Sample PURL:
# Amazon Corretto
pkg:generic/amazon/amazon-corretto@21.0.3 
# Oracle JDK
pkg:generic/oracle/jdk@11.0.16
# Oracle JRE
pkg:generic/oracle/jre@20

Nginx ecosystem collection

Supported applications

Nginx

Supported platforms

The following are supported platforms.

Linux

/usr/sbin/nginx
/usr/local/nginx
/usr/local/etc/nginx
/usr/local/nginx/nginx
/usr/local/nginx/sbin/nginx
/etc/nginx/nginx

Windows

C:\nginx\nginx.exe
C:\nginx-x.y.z\nginx.exe (x.y.z is an arbitrary version)

MacOS

/usr/local/etc/nginx/nginx

Key features

This collection examines binaries to extract embedded version information. It searches for version strings in the binary executable .rodata section (for ELF binaries on Linux), .rdata section (for PE binaries on Windows), or __ctring section (for MachO binaries).

Example version string

The following is an example of a version string embedded in an Nginx binary.


nginx version: nginx/1.27.5

Version 1.27.5 is extracted to identify the Nginx version.

Example PURL

The following is an example package URL for Nginx.


Sample PURL: pkg:generic/nginx/nginx@1.27.5

Node.JS runtime collection

Supported applications

node runtime binary for Node.JS

Supported artifacts

MacOS and Linux – node binary detection through binary details installed with asdf, fnm, nvm, volta, or official Node.JS containers.

Example MacOS and Linux paths

The following is an example of paths for MacOS and Linux.



NVM:   ~/.nvm/, /usr/local/nvm
FNM:   ~/.local/share/fnm/
ASDF:  ~/.asdf/
MISE:  ~/.local/share/mise/
VOLTA: ~/.volta/

Example PURL

The following is an example package URL for Node.JS.



Sample PURL: pkg:generic/nodejs/node@20.18.0

OpenSSH collection

Supported applications

OpenSSH (Version 9)
OpenSSH (Version 10)

Supported platforms Linux/MacOS

/usr/sbin/sshd
/usr/local/sbin/sshd

Supported platforms Windows

C:/Windows/System32/OpenSSH/sshd.exe
C:/Program Files/OpenSSH/sshd.exe
C:/Program Files (x86)/OpenSSH/sshd.exe
C:/OpenSSH/sshd.exe

Key features

Examines sshd binaries to extract embedded verion information.
Looks for version strings in the binary executable .rodata section (for ELF binaries on Linux, __cstring section (for Mach-O binaries on MacOs), or .rdata section (for PE binaries on Windows).

Example version string

The following is an example of a version string embedded in an OpenSSH binary.


OpenSSH_9.9p2

Version 9.9p2 is extracted to identify the OpenSSH version.

Example PURL

The following is an example package URL for OpenSSH.


Sample PURL: pkg:generic/openssh/openssh@9.9p2

OpenSSL ecosystem Collection

Supported applications

Support for OpenSSL libraries and development packages is limited to software built with official OpenSSL for 3.0.0 releases and above. The software also must follow semantic versioning. Custom or forked OpenSSL variants and versions lower than 3.0.0 are not supported.

The Amazon Inspector SBOM Generator extracts key package information for each installed OpenSSL instance.

Key features

Extracts the base SEMVER version string from the OpenSSL header file
Identifies the directory path containing the OpenSSL installation

The Amazon Inspector SBOM Generator looks for OpenSSL installations by scanning for the opensslv.h file in common installation paths across platforms.

Example installation path for Linux/Unix

The following is an example installation path for Linux/Unix.


/usr/local/include/openssl/opensslv.h
/usr/local/ssl/include/openssl/opensslv.h
/usr/local/openssl/include/openssl/opensslv.h
/usr/local/opt/openssl/include/openssl/opensslv.h
/usr/include/openssl/opensslv.h

The Amazon Inspector SBOM Generator extracts version information by parsing the opensslv.h file and looking for the version definitions.


# define OPENSSL_VERSION_MAJOR  3
# define OPENSSL_VERSION_MINOR  4
# define OPENSSL_VERSION_PATCH  0

Example PURL

The following is an example package URL for the OpenSSL version.


Sample PURL: pkg:generic/openssl/openssl@3.4.0

Oracle Database Server collection

Supported applications

Oracle Database

Supported platforms Linux

/opt/oracle
/u01/app/oracle

Note

Vulnerability evaluation applies only to Oracle Database Server version 19 and higher.

Key features

Examines Oracle binaries to extract embedded version information.
Looks for version strings in the binary executable .rodata section (for ELF binaries on Linux).
Version information follows a specific format that includes the RDBMS version string.

Example version string

The following is an example of a version string embedded in an Oracle Database binary:


RDBMS_23.7.0.25.01DBRU_LINUX.X64_240304

Version 23.7.0.25.01 is extracted to identify the Oracle Database version.

Example PURL

The following is an example package URL for Oracle Database.


Sample PURL: pkg:generic/oracle/database@23.7.0.25.01

WordPress ecosystem collection

Supported components

WordPress core
WordPress plugins
WordPress themes

Key features

WordPress core – parses the /wp-includes/version.php file to extract version value from $wp_version variable.
WordPress plugins – parses the /wp-content/plugins/<WordPress Plugin>/readme.txt file or /wp-content/plugins/<WordPress Plugin>/readme.md file to extract the Stable tag as the version string.
WordPress themes – parses the /wp-content/themes/<WordPress Theme>/style.css file to extract the version from the version metadata.

Example `version.php` file

The following is an example of a WordPress core version.php file.



// truncated

/**
* The WordPress version string.
*
* Holds the current version number for WordPress core. Used to bust caches
* and to enable development mode for scripts when running from the /src directory.
*
* @global string $wp_version
*/
$wp_version = '6.5.5';

// truncated

Example PURL

The following is an example package URL for WordPress core.



Sample PURL: pkg:generic/wordpress/core/wordpress@6.5.5

Example `readme.txt` file

The following is an example of a WordPress plugin readme.txt file.



=== Plugin Name ===
Contributors: (this should be a list of wordpress.org userid's)
Donate link: https://example.com/
Tags: tag1, tag2
Requires at least: 4.7
Tested up to: 5.4
Stable tag: 4.3
Requires PHP: 7.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

// truncated

Example PURL

The following is an example package URL for a WordPress plugin.



Sample PURL: pkg:generic/wordpress/plugin/exclusive-addons-for-elementor@1.0.0

Example `style.css` file

The following is an example of a WordPress theme style.css file.



/*
Author: the WordPress team
Author URI: https://wordpress.org
Description: Twenty Twenty-Four is designed to be flexible, versatile and applicable to any website. Its collection of templates and patterns tailor to different needs, such as presenting a business, blogging and writing or showcasing work. A multitude of possibilities open up with just a few adjustments to color and typography. Twenty Twenty-Four comes with style variations and full page designs to help speed up the site building process, is fully compatible with the site editor, and takes advantage of new design tools introduced in WordPress 6.4.
Requires at least: 6.4
Tested up to: 6.5
Requires PHP: 7.0
Version: 1.2
License: GNU General Public License v2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html
Text Domain: twentytwentyfour
Tags: one-column, custom-colors, custom-menu, custom-logo, editor-style, featured-images, full-site-editing, block-patterns, rtl-language-support, sticky-post, threaded-comments, translation-ready, wide-blocks, block-styles, style-variations, accessibility-ready, blog, portfolio, news
*/

Example PURL

The following is an example package URL for a WordPress theme.



Sample PURL: pkg:generic/wordpress/theme/avada@1.0.0

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Dependency collection

SSL/TLS certificate scans

Amazon Inspector SBOM Generator comprehensive ecosystem collection

Supported ecosystems

Apache ecosystem collection

Supported applications

Key features

Example ap_release.h file

Example PURL

Example catalina.jar/META-INF/MANIFEST.MF file

Example PURL

Google ecosystem collection

Supported application

Note

Supported artifacts

Example chrome/VERSION version file

Example PURL

Example puppeteer version file

Example PURL

Example PURL

Java ecosystem collection

Supported applications

Key features

Example Java version information

Example PURL

Nginx ecosystem collection

Supported applications

Supported platforms

Linux

Windows

MacOS

Key features

Example version string

Example PURL

Node.JS runtime collection

Supported applications

Supported artifacts

Example MacOS and Linux paths

Example PURL

OpenSSH collection

Supported applications

Supported platforms Linux/MacOS

Supported platforms Windows

Key features

Example version string

Example PURL

OpenSSL ecosystem Collection

Supported applications

Key features

Example installation path for Linux/Unix

Example PURL

Oracle Database Server collection

Supported applications

Supported platforms Linux

Note

Key features

Example version string

Example PURL

WordPress ecosystem collection

Supported components

Key features

Example version.php file

Example PURL

Example readme.txt file

Example PURL

Example style.css file

Example PURL

Example `ap_release.h` file

Example `catalina.jar/META-INF/MANIFEST.MF` file

Example `chrome/VERSION` version file

Example `puppeteer` version file

Example `version.php` file

Example `readme.txt` file

Example `style.css` file