Skip to content

README.md

Latest commit

 

History

History
122 lines (97 loc) · 5.31 KB

README.md

File metadata and controls

122 lines (97 loc) · 5.31 KB
Raw

CVE Fix

Automated CVE remediation that reads vulnerability details from a Jira ticket, applies multi-strategy dependency fixes, validates results, and creates pull requests with full justification. Language-agnostic: supports Go, Node.js, Python, Java, Rust, Ruby, and more.

Prerequisites

  • Jira access — via Jira MCP server or Jira CLI (jira), configured and authenticated (primary input is a Jira vulnerability ticket)
  • Python 3.10+ — for deterministic helper scripts (scripts/)
  • Vulnerability scanners (optional; used by /scan and /validate for pre/post-fix verification):
    • Go: govulncheck (go install golang.org/x/vuln/cmd/govulncheck@latest)
    • Node.js: npm audit (bundled with npm)
    • Python: pip-audit (pip install pip-audit)
  • skopeo — for verifying container image availability before patching (optional; used when fixed version references a container image)
  • gh CLI — for creating pull requests and checking for existing PRs (optional; manual fallback available)
  • git — for branch and commit operations

Phases

Phase Command What it does
Start /start Research Jira vulnerability ticket, gather context, detect ecosystem
Scan /scan Scan the repository to confirm the CVE is present before patching
Patch /patch Apply multi-strategy fixes with justification logging
Validate /validate Verify dependency updated, run tests, check for regressions
PR /pr Create pull request with strategy justification in body
Backport /backport Cherry-pick merged fix to release branches (optional, repeatable)
Close /close Verify PR(s) merged, update related Jira tickets to MODIFIED or ON_QA

The typical order is start → scan → patch → validate → pr → backport → close.

Usage

/cve-fix:start EDM-1234
/cve-fix:scan
/cve-fix:patch
/cve-fix:validate
/cve-fix:pr
/cve-fix:backport
/cve-fix:close

Multi-Strategy Patching

The /patch phase tries fixes in ascending order of risk:

  1. Direct update (minor/patch) — Update the vulnerable dependency to the nearest fixed version within the same major version
  2. Transitive dependency update — Update a direct dependency that pulls in the vulnerable transitive package
  3. Override/pin mechanism — Use language-specific overrides (Go replace, npm overrides, Maven dependencyManagement, etc.)
  4. Major version update — Update to a new major version (requires user approval due to breaking change risk)

Every strategy attempted is documented in the patch log, which becomes part of the PR description for full transparency.

Supported Ecosystems

Ecosystem Manifest Package Manager Override Mechanism
Go go.mod go replace directive
Node.js package.json npm/yarn/pnpm overrides/resolutions
Python requirements.txt/pyproject.toml pip/poetry/uv constraints/explicit pin
Java (Maven) pom.xml mvn <dependencyManagement>
Java (Gradle) build.gradle gradle constraints block
Rust Cargo.toml cargo [patch] section
Ruby Gemfile bundler direct version pin

Artifacts

All outputs are written to .artifacts/cve-fix/{context}/:

File Phase Content
context.md /start Jira research, CVE details, ecosystem, repository info
scan-result.json /scan Machine-readable scan verdict, scanner output, and VEX justification (if applicable)
scan-results.md /scan Human-readable scan verdict, interpretation, and VEX justification
patch-log.md /patch Strategy attempts, outcomes, justifications
pr-description.md /patch Draft PR body for user review before /pr
validation-results.md /validate Dependency verification, test results, related Jira tickets
backport-log.md /backport Backport attempts per release branch, PR URLs
close-report.md /close Merged PR summary, Jira ticket update results

Example: Fixing a Go CVE from a Jira Ticket

/start EDM-1234
  → Reads Jira ticket EDM-1234
  → Extracts: CVE-2025-53547 (HIGH), helm.sh/helm/v3 v3.14.2, fix in v3.15.0
  → Follows linked tickets/PRs for fix approach hints
  → Detected ecosystem: Go (go.mod)

/scan
  → Runs govulncheck with GOTOOLCHAIN=go1.22.0 (matched to go.mod)
  → Verdict: present — CVE-2025-53547 confirmed in helm.sh/helm/v3

/patch
  → Strategy 1 (direct update): go get helm.sh/helm/v3@v3.15.0 → Success
  → Patch log written with justification

/validate
  → Post-fix binary scan: govulncheck -mode binary confirms CVE resolved
  → Dependency verified: helm.sh/helm/v3 v3.15.0
  → Tests: PASS (42 tests, 0 failures)
  → Found 2 related Jira tickets with same CVE

/pr
  → Checks for existing PRs: none found
  → Branch: cve-fix/EDM-1234
  → Draft PR created with strategy justification and Jira ticket reference

/backport
  → PR merged on main
  → User selects target: release-2.16
  → Cherry-pick clean, backport PR created against release-2.16

/close
  → All PRs merged confirmed
  → User selects status: ON_QA
  → EDM-1234 and 2 related tickets updated to ON_QA