Jira Cve Tracker

Jira CVE Tracker

Queries a Jira project for open Vulnerability issues, deduplicates across container variants (one CVE = multiple issues per arch/variant), and estimates release dates based on SLA due dates.

Prerequisites

Required environment variables:

• JIRA_SITE — Atlassian site (e.g. yourorg.atlassian.net)
• JIRA_TOKEN — Atlassian API token
• JIRA_EMAIL — Your Atlassian account email

Required tools: jq, curl

Key Concepts

• CVE deduplication — one CVE ID typically maps to 3–10 Jira issues (one per container variant/architecture). The tracker deduplicates by CVE ID before counting.
• fixVersion — used to group CVEs by target release (e.g. 3.3.1, 3.3.2). More reliable than affectedVersion for filtering.
• duedate — SLA deadline by which the CVE must be fixed and shipped.
• Clustering — CVEs with no fix version are grouped into date clusters based on their due dates, using a configurable day window.

Scripts

estimate_release.sh — CVE-based release date estimation

./scripts/estimate_release.sh --project KEY [options]

Options:

• --project KEY — Jira project key to query (required)
• --fix-version VERSION — filter to a specific fix version
• --cluster-days N — day window for grouping unassigned issues (default: 14)
• --format table|json — output format (default: table)
• --verbose — show individual CVE IDs per group

Examples:

# Full overview: all open CVEs grouped by fix version + unassigned clusters
./scripts/estimate_release.sh --project MYPROJ

# CVEs targeting a specific fix version
./scripts/estimate_release.sh --project MYPROJ --fix-version "3.3.1"

# Tighter clustering, verbose
./scripts/estimate_release.sh --project MYPROJ --cluster-days 7 --verbose

# JSON for programmatic processing
./scripts/estimate_release.sh --project MYPROJ --format json | jq '.[] | select(.overdue)'

Output columns:

• Fix Version / Cluster — fix version name or Unassigned ~YYYY-MM date cluster
• CVEs — deduplicated CVE count
• Issues — total raw issue count (includes per-variant duplicates)
• Earliest Due / Latest Due — SLA date range
• Statuses — breakdown of issue statuses within group

---

check_cves.sh — Check specific CVEs against a project

./scripts/check_cves.sh --project KEY CVE-2026-1234 [CVE-2025-9999 ...]
echo "CVE-2026-1234" | ./scripts/check_cves.sh --project KEY

Output: one line per CVE:

OPEN    | CVE-2026-1234 | PROJ-101,PROJ-102
NO_CARD | CVE-2025-9999

Useful for bulk-checking a list of CVEs from a security advisory.

---

cve_tracker.sh — General-purpose CVE query engine

Low-level script used by estimate_release.sh. Can query any Jira project.

./scripts/cve_tracker.sh  [options]

Options:

• --filter SUBSTR — case-insensitive substring filter on issue summary
• --issue-type TYPE — issue type to query (default: Vulnerability)
• --status open|all — open excludes Closed issues (default)
• --cluster-days N — day window for grouping unassigned issues (default: 14)
• --format table|json — output format (default: table)
• --verbose — show individual CVE IDs per group (table mode)

Uses the Jira REST API directly (POST /rest/api/3/search/jql) because acli --fields rejects duedate and fixVersions. All analysis is performed with an embedded jq script.

---

cve_bulk_check.sh — Low-level CVE lookup

Low-level script used by check_cves.sh. Searches Vulnerability issues in any project.

./scripts/cve_bulk_check.sh --project KEY CVE-2026-1234 [...]
echo "CVE-2026-1234" | ./scripts/cve_bulk_check.sh --project KEY

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: aipcc-cicd
• Source: aipcc-cicd/claudio-skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.