jira-cve-tracker

name	jira-cve-tracker
description	Query a Jira project for open CVE Vulnerability issues, deduplicate across container variants, cluster by due date, and estimate release dates. Use this skill when the user asks about CVE status, which CVEs are blocking a release, when the next Z-stream should ship, or whether a specific CVE has an open Jira card.
allowed-tools	Bash(*/jira-cve-tracker/scripts/*.sh *)

Jira CVE Tracker

Queries a Jira project for open Vulnerability issues, deduplicates across container variants (one CVE = multiple issues per arch/variant), and estimates release dates based on SLA due dates.

Prerequisites

Required environment variables:

• JIRA_SITE — Atlassian site (e.g. yourorg.atlassian.net)
• JIRA_TOKEN — Atlassian API token
• JIRA_EMAIL — Your Atlassian account email

Required tools: jq, curl

Key Concepts

• CVE deduplication — one CVE ID typically maps to 3–10 Jira issues (one per container variant/architecture). The tracker deduplicates by CVE ID before counting.
• fixVersion — used to group CVEs by target release (e.g. 3.3.1, 3.3.2). More reliable than affectedVersion for filtering.
• duedate — SLA deadline by which the CVE must be fixed and shipped.
• Clustering — CVEs with no fix version are grouped into date clusters based on their due dates, using a configurable day window.

Scripts

estimate_release.sh — CVE-based release date estimation

./scripts/estimate_release.sh --project KEY [options]

Options:

• --project KEY — Jira project key to query (required)
• --fix-version VERSION — filter to a specific fix version
• --cluster-days N — day window for grouping unassigned issues (default: 14)
• --format table|json — output format (default: table)
• --verbose — show individual CVE IDs per group

Examples:

# Full overview: all open CVEs grouped by fix version + unassigned clusters
./scripts/estimate_release.sh --project MYPROJ

# CVEs targeting a specific fix version
./scripts/estimate_release.sh --project MYPROJ --fix-version "3.3.1"

# Tighter clustering, verbose
./scripts/estimate_release.sh --project MYPROJ --cluster-days 7 --verbose

# JSON for programmatic processing
./scripts/estimate_release.sh --project MYPROJ --format json | jq '.[] | select(.overdue)'

Output columns:

• Fix Version / Cluster — fix version name or Unassigned ~YYYY-MM date cluster
• CVEs — deduplicated CVE count
• Issues — total raw issue count (includes per-variant duplicates)
• Earliest Due / Latest Due — SLA date range
• Statuses — breakdown of issue statuses within group

---

check_cves.sh — Check specific CVEs against a project

./scripts/check_cves.sh --project KEY CVE-2026-1234 [CVE-2025-9999 ...]
echo "CVE-2026-1234" | ./scripts/check_cves.sh --project KEY

Output: one line per CVE:

OPEN    | CVE-2026-1234 | PROJ-101,PROJ-102
NO_CARD | CVE-2025-9999

Useful for bulk-checking a list of CVEs from a security advisory.

---

cve_tracker.sh — General-purpose CVE query engine

Low-level script used by estimate_release.sh. Can query any Jira project.

./scripts/cve_tracker.sh <project> [options]

Options:

• --filter SUBSTR — case-insensitive substring filter on issue summary
• --issue-type TYPE — issue type to query (default: Vulnerability)
• --status open|all — open excludes Closed issues (default)
• --cluster-days N — day window for grouping unassigned issues (default: 14)
• --format table|json — output format (default: table)
• --verbose — show individual CVE IDs per group (table mode)

Uses the Jira REST API directly (POST /rest/api/3/search/jql) because acli --fields rejects duedate and fixVersions. All analysis is performed with an embedded jq script.

---

cve_bulk_check.sh — Low-level CVE lookup

Low-level script used by check_cves.sh. Searches Vulnerability issues in any project.

./scripts/cve_bulk_check.sh --project KEY CVE-2026-1234 [...]
echo "CVE-2026-1234" | ./scripts/cve_bulk_check.sh --project KEY