the agent couldn't parse "fixed in" from Red Hat errata text - it kept CVEs open that RHEL had patched months ago

TL;DR

Errata prose is written for humans; the fixed-version facts live in structured sources. Stop regexing the advisory text and read Red Hat's security API or OVAL data, compare installed NVRs against fixed NVRs, and close what is confirmed patched. Keep prose parsing only as a low-confidence fallback.

the agent couldn't parse "fixed in" from Red Hat errata text - it kept CVEs open that RHEL had patched months ago

Use this when

• RHEL CVEs stay open long after the patch shipped.
• The agent's errata parser returns nothing or garbage for the fixed version.
• The backlog is full of "open" CVEs that rpm -q shows as patched.

Not for this skill when

• The system is genuinely unpatched. Then the ticket is correct; patch the host.
• You are not on RHEL/CentOS/Rocky. Other ecosystems have their own advisory formats.

Steps

1. Pick a sample of the stuck CVEs and check the installed package NVR against the errata's fixed NVR by hand. Verify: the installed version is at or above the fixed one, confirming these are parser failures, not missing patches.
2. Switch the agent to the structured source: Red Hat's Security Data API or the OVAL definitions, which carry fixed package NVRs as fields. Verify: the agent returns a fixed NVR for a test CVE without touching prose.
3. Compare installed vs fixed with proper RPM version comparison (not string comparison). Verify: epoch and release segments compare correctly on edge cases.
4. Close the confirmed-patched CVEs with the evidence (installed NVR, fixed NVR, errata ID). Verify: each closed ticket cites the comparison.
5. Demote prose parsing to fallback with a confidence flag; anything it "finds" in prose needs the structured check before closing. Verify: a prose-only hit stays open pending verification.

Variant phrasings

Red Hat errata fixed in parse

The short phrasing.

RHEL patched CVE still open

The symptom search.

errata text fixed version extraction

The parsing phrasing.

Compatibility: RHEL 7/8/9, CentOS, Rocky, Alma; Red Hat's Security Data API covers the family.

Why it happens

Errata text varies in phrasing ("fixed in", "updated to", "resolves"), and a regex written for one phrasing misses the rest. The agent was parsing the human-readable layer instead of the machine-readable layer that Red Hat publishes for exactly this purpose. Structured data exists; use it.

Edge cases / pitfalls

• Kernel and userspace errata ship on different rhythms; a CVE can be fixed in userspace errata while the kernel fix is still pending. Compare per package, not per CVE.
• Backported fixes keep the version number looking old; the release segment carries the fix, which is why string comparison fails.
• Extended Lifecycle Support errata live in a different stream; make sure the agent reads the stream your hosts actually consume.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_DEvEONU6y1OwcN6pLxovtw