Wiz Adds Cloud SBOM Search to Locate Vulnerable Software

Summary

Wiz says its agentless SBOM search can locate package versions across cloud resources, helping teams identify vulnerable or outdated libraries and assess exposure, including to xz-utils versions 5.6.0 and 5.6.1.

Key points

Wiz says its SBOM search identifies where specific software packages and versions are deployed across cloud environments.
The company says its agentless scanning covers active and inactive resources, while its sensor validates packages and libraries in use at runtime.
The feature can help teams locate obsolete or vulnerable libraries, including particular versions of Log4j, OpenSSL, and xz-utils, and plan targeted updates.
For xz-utils versions 5.6.0 and 5.6.1, Wiz says users can find affected resources such as container images and virtual machines, then filter by factors including public exposure and elevated privileges.
Wiz says it plans to add identification and alerts for open-source software licenses it considers non-commercially permissive.

Article Details

Event Type: Wiz announced expanded agentless SBOM search capabilities across cloud environments.
Impact: The capability helps organizations locate software packages and versions across cloud resources, identify potentially vulnerable or unsupported components, and assess exposure for remediation. The article uses the xz-utils backdoor associated with CVE-2024-3094 as an example of how teams could identify affected versions and prioritize exposed resources.