find

Find CVEs in Jira

Purpose

Discover and catalog CVE issues reported in PROJQUAY Jira. Query the Jira API, parse ticket summaries to extract structured data, and save results for the assess and fix phases.

Execution Style

Be concise. Brief status + final summary only.

Querying Jira... Found 7 CVEs

Results:
- PROJQUAY-12345: CVE-2026-44432 quay/quay-rhel9: urllib3 [quay-3.17]
- PROJQUAY-12346: CVE-2026-33210 quay/clair-rhel9: golang.org/x/net [quay-3.17]
...

Report: artifacts/quay-cvefix/find/cve-issues-20260529-143018.md

Prerequisites

• JIRA_API_TOKEN and JIRA_EMAIL environment variables
• jq installed for JSON parsing
• Access to redhat.atlassian.net

Process

1. Parse Arguments

• Parse command arguments for optional flags:
  • --ignore-resolved — exclude issues with status "Resolved"
  • --ignore-vex — exclude issues closed as "Not a Bug"
  • Container name filter (optional, e.g., quay/quay-rhel9)
• If no filter provided, find all CVEs for all Quay components

2. Verify Jira Access

Check for Jira MCP server first, then fall back to curl with Basic Auth:

JIRA_BASE_URL="https://redhat.atlassian.net"
AUTH=$(echo -n "${JIRA_EMAIL}:${JIRA_API_TOKEN}" | base64 | tr -d '\n')

TEST_RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -X GET \
  --connect-timeout 10 --max-time 15 \
  -H "Authorization: Basic ${AUTH}" \
  -H "Content-Type: application/json" \
  "${JIRA_BASE_URL}/rest/api/3/myself")

• HTTP 200 → proceed
• HTTP 401 → credentials invalid, inform user
• HTTP 000 → network issue, inform user

3. Query Jira for CVE Issues

Build JQL query:

JQL='project = PROJQUAY AND summary ~ "CVE*" AND labels = SecurityTracking'

# Optional filters
if [ "$IGNORE_RESOLVED" = "true" ]; then
  JQL="${JQL} AND status not in (\"Resolved\")"
fi
if [ "$IGNORE_VEX" = "true" ]; then
  JQL="${JQL} AND NOT (status = \"Closed\" AND resolution in (\"Not a Bug\", \"Obsolete\", \"Won'\''t Fix\"))"
fi

ENCODED_JQL=$(python3 -c "import urllib.parse; print(urllib.parse.quote('''${JQL}'''))")

RESPONSE=$(curl -s -X GET \
  --connect-timeout 10 --max-time 30 \
  --retry 3 --retry-delay 2 \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic ${AUTH}" \
  "${JIRA_BASE_URL}/rest/api/3/search/jql?jql=${ENCODED_JQL}&fields=key,summary,status,priority,created,description,issuelinks&maxResults=100")