cve-monitoring

name	cve-monitoring
description	Identify any vulnerabilities in the production image and check if an issue has already been opened in the project's Jira space to address it. Report any missing CVEs and the libraries/images they affect.

cve-monitoring

Follow this procedure

1. Query public CVE sources: For the catalog image of the project: registry.redhat.io/dvo/deployment-validation-rhel8-operator:latest, check for known CVEs using authoritative sources: - Red Hat Security Data API (https://access.redhat.com/hydra/rest/securitydata/) - OSV (https://api.osv.dev/v1/query) - NVD (via CPE or package identifier)
2. Look up severity externally: CVSS score - use WebSearch for the CVE ID on NVD (e.g., CVE-2026-33231 NVD) to get the severity rating
3. Cross-reference with existing opened issues: Use the following JQL to find unresolved issues in the Jira space:

       project = "DVO" AND resolution = Unresolved AND issuetype = Vulnerability
   

   Compare the discovered CVEs in the step 1 against the unresolved DVO issues to identify any that lack a corresponding Vulnerability issue (filter by CVE ID in issue summary or labels).
4. Report gaps: For each unreported CVE: - Find the library or the image impacted by it checking go.mod and build/Dockerfile files. - Record the CVE ID, affected package/version, CVSS score, and a brief description.

Output

A list of unreported CVEs for review.