---
name: red-hat-cve-explainer
description: Explain a CVE using Red Hat's severity rating system. Looks up the CVE, explains the rating, and suggests a course of action.
license: Apache-2.0
user_invocable: true
model: inherit
color: cyan
allowed-tools: get_cve_by_id list_advisories_by_cve get_errata_by_id list_advisory_packages
---

# Red Hat CVE Explainer

Extract `CVE-YYYY-NNNNN` from user message. If none, ask. Handle multiple CVEs separately in one response.

## Prerequisites

None — falls back to WebFetch if the Red Hat Security MCP is unavailable.

## When to Use This Skill

When the user asks about a specific CVE: what it is, its severity, or whether to patch.

## Workflow

1. Extract CVE ID from the user message.
2. Look up CVE metadata via `get_cve_by_id` (from `red-hat-security`) or WebFetch.
3. Look up linked advisories via `list_advisories_by_cve` or extract from CVE response.
4. Return severity, affected products, and action recommendation.

## Dependencies

- `red-hat-security` MCP (optional): provides `get_cve_by_id`, `list_advisories_by_cve`, `get_errata_by_id`, and `list_advisory_packages`.

## Lookup Sequence

CVE metadata (stop when you have data):
1. `get_cve_by_id` (from `red-hat-security`) — `cve_id`: `"<CVE-ID>"`
2. `WebFetch` -> `https://access.redhat.com/security/cve/<CVE-ID>`
3. No Red Hat data: say so, direct to `https://nvd.nist.gov/vuln/detail/<CVE-ID>`

Advisory/remediation (after step 1-2 succeeds):
1. `list_advisories_by_cve` (from `red-hat-security`) — `cve_id`: `"<CVE-ID>"` — linked RHSAs/RHBAs/RHEAs
2. `get_errata_by_id` (from `red-hat-security`) — `advisory_id`: `"<RHSA-ID>"` — synopsis, severity, affected products
3. `list_advisory_packages` (from `red-hat-security`) — `advisory_id`: `"<RHSA-ID>"` — package-level remediation detail

If Red Hat Security MCP unavailable: extract advisory IDs from CVE response or WebFetch, report without remediation detail.

## Advisory Types

| Prefix | Type | What it fixes |
|--------|------|---------------|
| RHSA | Red Hat Security Advisory | One or more CVEs -- highest urgency |
| RHBA | Red Hat Bug Advisory | Bug fixes only -- no CVE, no security urgency |
| RHEA | Red Hat Enhancement Advisory | New features/capabilities -- no security fix |

In Output, label each advisory by type: e.g., "RHSA-2024:1234 (Security Advisory)".

## Red Hat Severity

- Critical -- Remote unauthenticated, no user interaction; wormable or trivially automated
- Important -- Local privesc to root, authenticated RCE, or significant DoS
- Moderate -- Would be Critical/Important but requires unusual config, user interaction, or other preconditions
- Low -- Minimal real-world impact; exploitation requires unlikely circumstances

Scored with CVSS v3 (0.0-10.0). Scores may differ from NVD due to product-specific flags, hardening, and deployment context.

## Output

### [CVE ID]

**Severity:** [Red Hat rating] (CVSS [score])

**What it is:** 1-2 sentences plain language.

**Why [rating]:** Connect flaw to rating criteria -- ease of exploitation, auth/interaction requirements.

**Affected products:** Affected Red Hat products with fix status. Per advisory: ID + remediation from `list_advisory_packages` (and synopsis from `get_errata_by_id`). If no advisory: note fix is under investigation, include published mitigations.

**Action:**
- Critical -> "Patch immediately. Exploitable by remote unauthenticated attackers."
- Important -> "Patch at your next maintenance window."
- Moderate -> "Include in your regular update cycle."
- Low -> "Apply when convenient. Monitor for severity changes."
- No patch -> include published mitigations from Red Hat's CVE page.

Write for a sysadmin deciding urgency. If Red Hat CVSS differs significantly from NVD, briefly note scores are product-specific. Never speculate about exploit availability beyond Red Hat's data.