Software Bill of Materials in Percona Server for MongoDB

Percona Server for MongoDB (PSMDB) now ships CycloneDX SBOM files in its Debian/RPM packages, binary tarballs, and Docker images starting with versions 7.0.39-21, 8.0.28-12, and 8.3.7-1. The post explains how to scan these SBOMs using Grype or OWASP Dependency Track (Trivy skips most PSMDB dependencies), walks through several false-positive CVEs (in gRPC, ICU4C, LibTomCrypt) caused by wide CPE matches, excluded build code, or local patches, and introduces accompanying VEX documents that filter these false positives out. It also warns that SBOM scans don't cover runtime-linked shared libraries (glibc, OpenSSL, libcurl, etc.), which should be scanned separately.

Source: https://www.percona.com/blog/software-bill-of-materials-in-percona-server-for-mongodb. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.