Demo: triaging a critical CVE
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
triage and fix a critical finding in a Shop service. Prepares MID-053-LAB1.
Draft outline details
Step by step
- A scan flags a critical CVE in a library inside
orders. Open the SBOM to confirm the component and the services affected. - Check reachability and exposure: is the vulnerable class used, is the endpoint public.
- Planned mistake: suppress the finding as "noise" without reading it. Fix: read the advisory; here the code path is reachable, so it is a real risk.
- Upgrade the library (or its parent BOM), run tests and the contract tests, and rebuild the image.
- Confirm the scan is clean and record the decision; document any exception with an expiry date.
Check your understanding
When may you accept a finding?
Show answer
When it is not reachable or mitigated, recorded with a reason, an owner, and an expiry date.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.