Systems and methods for patching vulnerabilities

An automated vulnerability remediation system, comprising:

• a non-transitory memory;
• and
• one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
• receiving a notification that a first version of a software component contains a vulnerability;
• accessing a database comprising metadata corresponding to a plurality of software applications, the metadata comprising a mapping of each of the plurality of software applications to one or more of a plurality of software components and a mapping of each of the software components to a respective version number;
• identifying a first software application comprising the first version of the software component in the plurality of software applications having the first version of the software component using the accessed database;
• evaluating the first software application and a second software application from the plurality of software applications against a blacklist of software applications;
• determining an indication that the second software application is included on the blacklist of software applications;
• removing the second software application from the plurality of software applications to create a second plurality of software applications;
• cloning, using a build system, remaining ones of the identified first software application to generate a cloned software application;
• replacing the first version of the software component containing the vulnerability in the cloned first software application with a second version of the software component to generate a patched first software application, the second version of the software component not containing the vulnerability;
• deploying, using an application programming interface associated with a cloud computing test environment, the patched first software application to the cloud computing test environment;
• and
• based on a successful deployment of the cloned first software application to the test environment, deploying the patched first software application to a cloud computing production environment.

A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

• responsive to a notification that a first version of a software component contains a vulnerability, identifying one or more software applications comprising the first version of the software component in a database comprising metadata corresponding to a plurality of software applications, each of the one or more software applications including the first version of the software component;
• evaluating the first one or more software applications against a blacklist of software applications;
• determining that an indication of a first software application of the first one or more software applications is included on the blacklist of software applications;
• removing the first software application from the first one or more software applications;
• cloning, using a build system, remaining ones of the identified one or more software applications to generate one or more cloned software applications;
• replacing the first version of the software component containing the vulnerability in each cloned software application with a second version of the software component to generate one or more patched software applications, the second version of the software component not containing the vulnerability;
• deploying, using an application programming interface associated with a cloud computing test environment, each patched software application to the cloud computing test environment;
• and
• based on a successful deployment of a first patched software application in the patched software applications to the test environment, deploying the first patched software application to a cloud computing production environment.