RHACS CVE Validation and False-Positive Handling

---

⚠️ Important disclaimer

This project is prototype- and demonstration-quality software. It was developed rapidly for exploratory and demo purposes and is not intended for production use. The codebase has not undergone formal security review, comprehensive testing, or hardening for operational environments. Use it only in non-critical, demo or evaluation contexts and at your own risk. Do not rely on it for production security decisions, automated policy changes, or any workflow where correctness and reliability are required.

---

Validate CVEs from Red Hat Advanced Cluster Security for Kubernetes (RHACS) against the Red Hat Security Data API (CVE, CSAF/VEX, OVAL) and optionally mark false positives in RHACS.

Goals

1. CVE validation: Fetch CVEs from RHACS (Image and Node/Platform scanning), validate each against Red Hat APIs to verify correctness.
2. False-positive workflow: Optionally create and approve false-positive exceptions in RHACS for CVEs that Red Hat data shows as "Not affected".

Requirements

• Python 3.10+
• requests, python-dotenv (optional, for loading .env)

pip install -r requirements.txt

Configuration

• RHACS: Central URL and API token (required for fetch and for apply-FP).
• Red Hat Security Data API: Public; optional REDHAT_SECURITY_DATA_URL and proxy via HTTPS_PROXY.

Environment variables

Variable	Description
RHACS_URL	RHACS Central URL (e.g. https://central.example.com)
RHACS_TOKEN	API token for Central
RHACS_VERIFY_TLS	Set to false to disable TLS verification (default: true)
REDHAT_SECURITY_DATA_URL	Red Hat Security Data API base URL (default: public API)
OUTPUT_FORMAT	csv or json
OUTPUT_FILE	Write report to this file (default: stdout)
APPLY_FP	Set to true/1 to create and approve false-positive exceptions
APPROVE_FP	Set to false to only create, not approve (default: true when APPLY_FP)
FP_COMMENT	Comment for false-positive exceptions
RHCOS_VERSION	Running RHCOS version (e.g. 9.6.20260204-0); used if RHACS/oc cannot provide it
OPENSHIFT_VERSION or CLUSTER_VERSION	Running OpenShift version (e.g. 4.20.14); used if RHACS/oc cannot provide it
USE_V1_FOR_IMAGE_CVES	Set to true/1 to fetch image CVEs via v1 REST API (avoids GraphQL pagination issues; see below)

You can set these in the environment or in a .env file in the project root. The app loads .env automatically when present (via python-dotenv). Do not commit .env—it is in .gitignore and typically contains secrets like RHACS_TOKEN.

OpenShift and RHCOS versions for "not affected" context are resolved in order: (1) RHACS (cluster openshiftVersion, node osImage preferred over kernelVersion), (2) env vars above, (3) if still missing and oc is in PATH with cluster context: oc version -o json and oc adm release info <version> --pullspecs (machine-os).

Usage

1. Validate only (report to stdout as CSV):

   export RHACS_URL=https://central.example.com
   export RHACS_TOKEN=your-token
   python main.py

2. Report to file (JSON):

   python main.py --format json -o report.json

3. Create and approve false-positives for CVEs that Red Hat marks as "Not affected":

   python main.py --apply-fp

   Use --no-approve to only create exceptions without approving them.

   Restrict which vulnerability types are marked (image, node, platform):

   python main.py --apply-fp --apply-fp-scope image          # only image CVEs
   python main.py --apply-fp --apply-fp-scope image,node     # image and node, not platform

4. All options:

   python main.py \
     --rhacs-url https://central.example.com \
     --rhacs-token "$TOKEN" \
     --format csv \
     -o report.csv \
     [--apply-fp] [--no-approve] [--fp-comment "Custom comment"] [--apply-fp-scope image,node,platform]

Project layout

• redhat/ – Red Hat Security Data API client (CVE, CSAF, OVAL).
• rhacs/ – RHACS Central client (GraphQL for image/node CVE list, REST v2 for vulnerability exceptions).
• validate/ – Validation logic (compare RHACS vs Red Hat, classify not_affected, etc.).
• fp/ – False-positive workflow (create + approve via v2 API).
• config.py – Config from environment.
• main.py – CLI entrypoint.

RHACS GraphQL and v1 REST

Image, node, and platform CVE listing uses Central’s GraphQL API by default. If your report shows far fewer image CVEs than in the RHACS UI (e.g. due to GraphQL pagination issues), you can fetch image CVEs via the v1 REST API instead: run with --use-v1-api or set USE_V1_FOR_IMAGE_CVES=true. That path uses v1/deployments and v1/images/{id} (as in the StackRox export script) and avoids GraphQL. Node and platform CVEs are still from GraphQL.

If your RHACS version uses different operation or field names, you can extend rhacs/client.py or use raw_graphql() with your own queries. See RHACS API reference.

References

• RHACS Vulnerability Exception Service (v4.8)
• Red Hat Security Data API
• Red Hat CSAF/VEX

License

GPL-3.0 (see LICENSE).