Cve Remediation

// Example: Test that vulnerable version is NOT present
def "should not use vulnerable log4j version"() {
    when:
    def dependencies = project.configurations.runtimeClasspath.resolvedConfiguration.resolvedArtifacts

    then:
    !dependencies.any { it.name == 'log4j-core' && it.moduleVersion.id.version.startsWith('2.14') }
}

# Before
log4jVersion=2.14.1

# After (with comment explaining why)
# Updated from 2.14.1 to fix CVE-2021-44228 (Log4Shell)
log4jVersion=2.17.1

// Exclude vulnerable transitive dependency
dependencies {
    implementation('some-library:1.0') {
        exclude group: 'vulnerable-lib', module: 'vulnerable-module'
    }
    // Add fixed version explicitly
    implementation 'vulnerable-lib:vulnerable-module:fixed-version'
}

{
  "dependencies": {
    "vulnerable-package": "^fixed.version"
  },
  "overrides": {
    "transitive-vulnerable": "^fixed.version"
  }
}

# Format code
./gradlew spotlessApply

# Quick compilation check
./gradlew compileGroovy compileJava

# Check gradle dependencies
./gradlew dependencies | grep -i "vulnerable-library"

# Check npm dependencies
npm list vulnerable-package

# Verify version in build output
./gradlew build --info | grep "vulnerable-library"

# Full test suite (REQUIRED)
./gradlew test

# Specific module tests
./gradlew :affected-module:test

# Frontend tests
CORE_UI=rundeckapp/grails-spa/packages/ui-trellis
npm run --prefix "$CORE_UI" ci:test:unit

# API functional tests
./gradlew :functional-test:apiTest

# Selenium tests (if UI affected)
./gradlew :functional-test:seleniumTest

# Full build
./gradlew build

# Start application locally
./gradlew bootRun

# Manual smoke test checklist:
# - Application starts without errors
# - Login works
# - Core functionality works
# - No new warnings/errors in logs

# Re-run security scanner
./gradlew dependencyCheckAnalyze

# Check for CVE in updated dependencies
./gradlew dependencies | grep -i "CVE"

# Frontend audit
npm audit
npm audit fix --dry-run

Title: Fix CVE-XXXX-XXXX in [library]
Labels: security
Body:
  CVE: CVE-XXXX-XXXX
  Affected: [library] version [X.X.X]
  Severity: [CVSS score and rating]
  Fix: Upgrade to version [Y.Y.Y]
  Impact: [Description of impact on Rundeck]

  Links:
  - NVD: https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXX
  - Vendor advisory: [link]

Fix CVE-XXXX-XXXX in [library]

Upgrade [library] from [old-version] to [new-version] to address
security vulnerability CVE-XXXX-XXXX.

Vulnerability Details:
- Severity: [Critical/High/Medium/Low]
- CVSS: [score]
- Impact: [brief description]

Changes:
- Updated [library]Version in gradle.properties
- Ran full test suite - all passing
- Verified no functional regressions

gh pr create --title "Fix CVE-XXXX-XXXX in [library]" --body "..."

## Security Fix

**CVE:** CVE-XXXX-XXXX
**Severity:** [Critical/High/Medium/Low] (CVSS [score])
**Affected:** [library] [version-range]
**Fix:** Upgrade to [new-version]

**Impact Assessment:**
- [X] Direct dependency / [ ] Transitive dependency
- [X] Production code / [ ] Test code only
- Exploitable: [Yes/No - explanation]

**Testing:**
- [X] All unit tests pass
- [X] All functional tests pass
- [X] Manual smoke test completed
- [X] Security scan shows CVE resolved

**References:**
- NVD: https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXX
- Vendor advisory: [link]

## [Date] - CVE-XXXX-XXXX

**Fixed in:** Version X.Y.Z
**CVE:** CVE-XXXX-XXXX
**Severity:** [level]
**Component:** [library] [old-version] → [new-version]
**Impact:** [description]
**Credit:** [who reported it]

1. Search for dependency in gradle.properties
2. Update version
3. Run ./gradlew dependencies to verify
4. Run ./gradlew test
5. Create PR

1. Find which direct dependency pulls it in
2. Add explicit dependency with fixed version
3. Or exclude vulnerable transitive and add fixed version
4. Verify with ./gradlew dependencies
5. Run tests and create PR

1. cd to package directory
2. Run npm audit
3. Update package.json or use overrides
4. Run npm test
5. Commit and create PR

1. Document the issue in a GitHub issue
2. Assess actual risk/exploitability
3. Implement workarounds if needed
4. Set up monitoring/alerts
5. Schedule re-assessment when fix available

# Find dependency in project
rg "library-name" gradle.properties build.gradle

# Check dependency tree
./gradlew dependencies | grep "library-name"

# Update and verify
vim gradle.properties  # Update version
./gradlew spotlessApply
./gradlew compileGroovy compileJava
./gradlew test

# Security checks
./gradlew dependencyCheckAnalyze
npm audit

# Create PR
git checkout -b fix-cve-xxxx-xxxx
git add gradle.properties
git commit -m "Fix CVE-XXXX in library"
gh pr create --web