cve-remediation

name	cve-remediation
description	Verify if a CVE affects the project and remediate it. Checks dependencies, identifies vulnerable versions, suggests/applies fixes, and validates changes. Use when analyzing security vulnerabilities or responding to CVE reports.

CVE Remediation Skill

Systematic process for verifying and remediating CVE (Common Vulnerabilities and Exposures) impacts on Rundeck.

When to Use

• Security team reports a CVE
• Automated security scan identifies vulnerability
• Upstream dependency announces security issue
• Proactive security review
• Before major releases

Process Overview

1. CVE Analysis → 2. Dependency Check → 3. Impact Assessment → 4. Fix Strategy → 5. Implementation → 6. Validation → 7. Documentation

Phase 1: CVE Analysis

Input Required

• CVE ID: e.g., CVE-2024-1234
• CVE Details: Description, affected versions, severity
• Source: Where the CVE was reported (scanner, security team, upstream)

Gather Information

# Quick CVE lookup
curl -s "https://cve.circl.lu/api/cve/${CVE_ID}" | jq

# Or use NVD API
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=${CVE_ID}"

What to extract:

• Affected library/component
• Vulnerable version ranges
• Fixed versions available
• CVSS score and severity
• Attack vector and exploitability

Phase 2: Dependency Check

Step 1: Identify Dependency Locations

Check these files for dependency definitions:

# Root dependencies
cat gradle.properties

# All build files
find . -name "build.gradle" -not -path "*/node_modules/*"

# Frontend dependencies
cat rundeckapp/grails-spa/packages/ui-trellis/package.json

Step 2: Search for Vulnerable Dependency

Use Grep to find the dependency across the codebase:

# Example: Search for log4j versions
rg "log4j" gradle.properties build.gradle
rg "log4jVersion" --type gradle

# Example: Search for jackson versions
rg "jackson" gradle.properties

Step 3: Check Transitive Dependencies

# Generate dependency tree
./gradlew dependencies > dependency-tree.txt

# Search for vulnerable library in tree
grep -i "vulnerable-library" dependency-tree.txt

# Check specific module
./gradlew :module-name:dependencies

Step 4: Frontend Dependencies

# Check npm dependencies
cd rundeckapp/grails-spa/packages/ui-trellis
npm list <vulnerable-package>

# Check for vulnerabilities
npm audit
npm audit --json | jq '.vulnerabilities'

Phase 3: Impact Assessment

Determine Impact Level

Critical Impact:

• Direct dependency
• Used in production code paths
• Exploitable in our deployment
• High CVSS score (7.0+)

Medium Impact:

• Transitive dependency
• Used in non-critical paths
• Requires specific conditions to exploit
• Medium CVSS score (4.0-6.9)

Low Impact:

• Test-only dependency
• Not used in production
• Difficult to exploit in our context
• Low CVSS score (<4.0)

Document Findings

Create a summary:

## CVE Impact Assessment: ${CVE_ID}

**Affected Component:** [library name and version]
**Current Version:** [version in project]
**Vulnerable Versions:** [range from CVE]
**Fixed Version:** [recommended upgrade]
**Severity:** [Critical/High/Medium/Low]
**Impact on Rundeck:** [Direct/Transitive/Not Affected]

**Usage in Project:**
- Location: [file paths]
- Modules affected: [list]
- Production impact: [Yes/No - explain]

**Exploitability:**
- Attack vector: [Local/Network/Adjacent]
- Requires: [Authentication/User interaction/etc]
- Impact on us: [likely/unlikely - explain]

Phase 4: Fix Strategy

Strategy A: Version Upgrade (Preferred)

When to use:

• Fixed version available
• Upgrade is backward compatible
• No breaking changes

Steps:

1. Identify fixed version from CVE report
2. Check for breaking changes in changelog
3. Plan upgrade path
4. Update version in gradle.properties or build.gradle

Strategy B: Dependency Exclusion + Alternative

When to use:

• Fixed version not available
• Upgrade has breaking changes
• Vulnerability is in transitive dependency we don't use

Steps:

1. Identify which direct dependency pulls in vulnerable library
2. Exclude vulnerable transitive dependency
3. Add explicit dependency on fixed version
4. Verify functionality

Strategy C: Workaround/Mitigation

When to use:

• No fix available yet
• Upgrade not feasible immediately
• Need temporary protection

Options:

• Configuration changes to disable vulnerable features
• Network/firewall rules
• Input validation
• WAF rules
• Runtime monitoring

Strategy D: Accept Risk (Documented)

When to use:

• Low impact
• Not exploitable in our environment
• Fix causes more issues than vulnerability

Requirements:

• Document decision in a GitHub issue
• Get security team approval
• Add to risk register
• Set reminder to revisit

Phase 5: Implementation

Write Tests First

Even for dependency upgrades, write a test first:

// Example: Test that vulnerable version is NOT present
def "should not use vulnerable log4j version"() {
    when:
    def dependencies = project.configurations.runtimeClasspath.resolvedConfiguration.resolvedArtifacts

    then:
    !dependencies.any { it.name == 'log4j-core' && it.moduleVersion.id.version.startsWith('2.14') }
}

Update Dependencies

For gradle.properties:

# Before
log4jVersion=2.14.1

# After (with comment explaining why)
# Updated from 2.14.1 to fix CVE-2021-44228 (Log4Shell)
log4jVersion=2.17.1

For build.gradle:

// Exclude vulnerable transitive dependency
dependencies {
    implementation('some-library:1.0') {
        exclude group: 'vulnerable-lib', module: 'vulnerable-module'
    }
    // Add fixed version explicitly
    implementation 'vulnerable-lib:vulnerable-module:fixed-version'
}

For package.json:

{
  "dependencies": {
    "vulnerable-package": "^fixed.version"
  },
  "overrides": {
    "transitive-vulnerable": "^fixed.version"
  }
}

Run Formatting and Compilation

# Format code
./gradlew spotlessApply

# Quick compilation check
./gradlew compileGroovy compileJava

Phase 6: Validation

Step 1: Verify Dependency Updated

# Check gradle dependencies
./gradlew dependencies | grep -i "vulnerable-library"

# Check npm dependencies
npm list vulnerable-package

# Verify version in build output
./gradlew build --info | grep "vulnerable-library"

Step 2: Run Test Suite

# Full test suite (REQUIRED)
./gradlew test

# Specific module tests
./gradlew :affected-module:test

# Frontend tests
CORE_UI=rundeckapp/grails-spa/packages/ui-trellis
npm run --prefix "$CORE_UI" ci:test:unit

Step 3: Functional Testing

# API functional tests
./gradlew :functional-test:apiTest

# Selenium tests (if UI affected)
./gradlew :functional-test:seleniumTest

Step 4: Build and Smoke Test

# Full build
./gradlew build

# Start application locally
./gradlew bootRun

# Manual smoke test checklist:
# - Application starts without errors
# - Login works
# - Core functionality works
# - No new warnings/errors in logs

Step 5: Security Verification

# Re-run security scanner
./gradlew dependencyCheckAnalyze

# Check for CVE in updated dependencies
./gradlew dependencies | grep -i "CVE"

# Frontend audit
npm audit
npm audit fix --dry-run

Phase 7: Documentation

Create a GitHub Issue

If not already created:

Title: Fix CVE-XXXX-XXXX in [library]
Labels: security
Body:
  CVE: CVE-XXXX-XXXX
  Affected: [library] version [X.X.X]
  Severity: [CVSS score and rating]
  Fix: Upgrade to version [Y.Y.Y]
  Impact: [Description of impact on Rundeck]

  Links:
  - NVD: https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXX
  - Vendor advisory: [link]

Commit Message

Fix CVE-XXXX-XXXX in [library]

Upgrade [library] from [old-version] to [new-version] to address
security vulnerability CVE-XXXX-XXXX.

Vulnerability Details:
- Severity: [Critical/High/Medium/Low]
- CVSS: [score]
- Impact: [brief description]

Changes:
- Updated [library]Version in gradle.properties
- Ran full test suite - all passing
- Verified no functional regressions

Create Pull Request

gh pr create --title "Fix CVE-XXXX-XXXX in [library]" --body "..."

PR Description (in addition to template):

## Security Fix

**CVE:** CVE-XXXX-XXXX
**Severity:** [Critical/High/Medium/Low] (CVSS [score])
**Affected:** [library] [version-range]
**Fix:** Upgrade to [new-version]

**Impact Assessment:**
- [X] Direct dependency / [ ] Transitive dependency
- [X] Production code / [ ] Test code only
- Exploitable: [Yes/No - explanation]

**Testing:**
- [X] All unit tests pass
- [X] All functional tests pass
- [X] Manual smoke test completed
- [X] Security scan shows CVE resolved

**References:**
- NVD: https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXX
- Vendor advisory: [link]

Update Security Documentation

If the project has a security changelog or vulnerability log, update it:

## [Date] - CVE-XXXX-XXXX

**Fixed in:** Version X.Y.Z
**CVE:** CVE-XXXX-XXXX
**Severity:** [level]
**Component:** [library] [old-version] → [new-version]
**Impact:** [description]
**Credit:** [who reported it]

Common Scenarios

Scenario 1: Gradle Dependency CVE

1. Search for dependency in gradle.properties
2. Update version
3. Run ./gradlew dependencies to verify
4. Run ./gradlew test
5. Create PR

Scenario 2: Transitive Dependency CVE

1. Find which direct dependency pulls it in
2. Add explicit dependency with fixed version
3. Or exclude vulnerable transitive and add fixed version
4. Verify with ./gradlew dependencies
5. Run tests and create PR

Scenario 3: Frontend NPM Package CVE

1. cd to package directory
2. Run npm audit
3. Update package.json or use overrides
4. Run npm test
5. Commit and create PR

Scenario 4: No Fix Available Yet

1. Document the issue in a GitHub issue
2. Assess actual risk/exploitability
3. Implement workarounds if needed
4. Set up monitoring/alerts
5. Schedule re-assessment when fix available

Checklist

Use this checklist for every CVE remediation:

• CVE analyzed and understood
• Affected dependencies identified
• Impact assessed (Critical/High/Medium/Low)
• Fix strategy determined
• GitHub issue created (if not already)
• Branch created (fix-cve-description)
• Dependencies updated with comments
• Code formatted (./gradlew spotlessApply)
• Compilation passes (./gradlew compileGroovy compileJava)
• All tests pass (./gradlew test)
• Functional tests pass
• Manual smoke test completed
• Security scan confirms fix
• Commit message includes CVE reference
• PR created with security details
• PR description includes CVE details
• Security team notified (if critical)
• Documentation updated

Quick Reference Commands

# Find dependency in project
rg "library-name" gradle.properties build.gradle

# Check dependency tree
./gradlew dependencies | grep "library-name"

# Update and verify
vim gradle.properties  # Update version
./gradlew spotlessApply
./gradlew compileGroovy compileJava
./gradlew test

# Security checks
./gradlew dependencyCheckAnalyze
npm audit

# Create PR
git checkout -b fix-cve-xxxx-xxxx
git add gradle.properties
git commit -m "Fix CVE-XXXX in library"
gh pr create --web

See Also

• Testing: .claude/docs/testing-guidelines.md
• Conventions: CLAUDE.md - Code conventions, git workflow, dependency management
• Build Commands: .claude/docs/build-commands.md