[6.19.z] Update IoP Vulnerability e2e test to apply erratum and verify remediation (#21186)

Author: Satellite-QE

robottelo/constants/__init__.py

@@ -991,6 +991,7 @@
 # Vulnerability testing constants for RHEL 10
 RHEL10_VULNERABLE_MARIADB_RPM = 'mariadb-3:10.11.11-1.el10.x86_64'
 RHEL10_VULNERABLE_MARIADB_CVES = ['CVE-2023-52969', 'CVE-2023-52970', 'CVE-2023-52971']
+RHEL10_MARIADB_ERRATUM = 'RHSA-2026:0136'
 # Use the first CVE as the primary one for single-CVE tests
 RHEL10_VULNERABILITY_CVE_ID = RHEL10_VULNERABLE_MARIADB_CVES[0]
 FAKE_1_YUM_REPOS_COUNT = 32

tests/foreman/ui/test_rhcloud_insights_vulnerability.py

@@ -12,7 +12,10 @@
 
 """
 
+from datetime import UTC, datetime, timedelta
+
 import pytest
+from wait_for import wait_for
 
 from robottelo import constants
 
@@ -90,10 +93,13 @@ def test_rhcloud_insights_vulnerabilities_e2e(
         4. Downgrade package on host to create vulnerability for detection by vulnerability engine.
         5. In Satellite UI, go to Vulnerabilities tab on Host Details page and validate the data.
         6. In Satellite UI, go to Vulnerability page and validate the data.
+        7. Remediate the vulnerability from the Satellite UI.
+        8. Verify that the vulnerabilities created in step 4 no longer affect the host.
 
     :expectedresults:
         1. Local insights vulnerability engine detects the new vulnerabilities.
         2. Vulnerability data is displayed correctly for impacted host in Satellite.
+        3. Vulnerabilities are no longer displayed after remediation.
 
     :verifies: SAT-30762
     """
@@ -126,6 +132,37 @@ def test_rhcloud_insights_vulnerabilities_e2e(
             vuln.get('CVE ID') == constants.RHEL10_VULNERABILITY_CVE_ID for vuln in vulnerabilities
         )
 
+        # Apply the erratum that mitigates the CVEs
+        timestamp = (datetime.now(UTC) - timedelta(minutes=2)).strftime('%Y-%m-%d %H:%M')
+        session.host_new.apply_erratas(
+            entity_name=hostname,
+            search=f'errata_id == {constants.RHEL10_MARIADB_ERRATUM}',
+        )
+
+        # Wait for applicability to generate on the host after remediation
+        wait_for(
+            lambda: (
+                satellite.api.ForemanTask()
+                .search(
+                    query={
+                        'search': f'label = Actions::RemoteExecution::RunHostsJob '
+                        f'and started_at >= "{timestamp}"'
+                    }
+                )[0]
+                .result
+                == 'success'
+            ),
+            timeout=400,
+            delay=15,
+            silent_failure=True,
+            handle_exception=True,
+        )
+
+        vulnerabilities = session.host_new.get_vulnerabilities(hostname)
+        cve_ids = [vuln['CVE ID'] for vuln in vulnerabilities]
+        for mariadb_cve in constants.RHEL10_VULNERABLE_MARIADB_CVES:
+            assert mariadb_cve not in cve_ids
+
 
 @pytest.mark.e2e
 @pytest.mark.no_containers