Request for SBOM and CPE Identifier for nRF5 SDK v15.3

[Bianca Glasner]

Hi,

We’re looking for the SBOM and the official CPE identifier for the Nordic nRF5 SDK, specifically version 15.3.

We would need:

1. The SBOM for nRF5 SDK v15.3
2. The CPE identifier that Nordic associates with this SDK, so we can correctly track any related vulnerabilities in the NVD.

A search in the NVD CPE database (https://nvd.nist.gov/products/cpe/) did not give us a conclusive result.

Could you please provide:

• The SBOM for nRF5 SDK v15.3 (or guidance on where to obtain it), and
• The exact CPE name/identifier you recommend using for this SDK in vulnerability management tools?

Thank you in advance for your support.

[Simonr]

Hi

SBOM generation is not supported for the nRF5 SDK I'm afraid, and there are no plans to add this from our side as this SDK is in maintenance mode ( nRF Connect SDK and nRF5 SDK statement ).

It's still possible to create an SBOM, but you would need to do so manually, by scanning your source code and build outputs with a third party tool and adding details like toolchains and precompiled libraries yourself. Unfortunately we don't have specific tools to recommend.

Best regards,

Simon

[Bianca Glasner]

Hey Simonr , 

thanks for your fast reply on this and the explanation of the case here. 

At this point all is clear to me and we'll evaluate further internally. 

Best,

Bianca