CentOS7_CVE-2021-3712_Remediation

:toc: :toclevels: 4

== Problem

• Customer has old CentOS7 box which is EOL
• CentOS7 is running older openssl which is affected by link:https://nvd.nist.gov/vuln/detail/cve-2021-3712[cve-2021-3712]
• How openssl on old Centos7 should be patched for CVE?

== Steps

1. link:./docs/1.CVE-2021-3712-analysis.adoc[Triage CVEs/vulnerabilities using NVD, CVSS/EPSS scores, and CISA KEV data]
2. link:./docs/2.Create_Run_CentOS7_Container.adoc[Create CentOS7 Docker image, run in Container using Vault repos]
3. link:./docs/3.Get_openssl_SourceCode_From_SRPM.adoc[Get the Openssl Source Code from srpm, where fix(patch) need to go]
4. link:./docs/4.PreparePatch_AddChangelog_BumpReleaseVer_inSPECFile.adoc[Create Patch, Add changelog, bump release version in SPEC File]
5. link:./docs/5.ApplyPatch_RebuildSRPM.adoc[Apply Patch, Build RPM]
6. link:./docs/6.MockBuild_and_Verification.adoc[Mock Build & Reproduction]. Mock builds srpm from patch in controlled env, ie system libs cannot interfere. Reproduce the CVE locally, apply the fix and check fix is working or not.
7. link:./docs/7.Sign_created_SRPMfile_HostOnArtifactory.adoc[Sign the SRPM]
8. link:./docs/8.CreateRemediationReport.adoc[Remediation Report]. Create the report of what all work done to remediate the CVE