Using grep to find CRITICAL vulnerabilities in report file - security

Question

I wonder if you can help... I'm currently implementing container scanning on one of my images in Gitlab and want to use grep to search for any CRITICAL vulnerabilities.
So far I have the below but the problem is, with the report it mentions CRITICAL then the number of vulnerabilities found whereas I was hoping to ignore that and look for where it mentions CRITICAL under SEVERITY.
I guess ideally i'd want the grep to work if it found CRITICAL > 0 under the total row but i'm not sure how to do this with grep so any help appreciated!
Code:
if cat REPORT.txt | grep -e 'CRITICAL'; then
echo 'Critical vulnerability found -- fail build' currentBuild.result = 'FAILURE'
else
echo 'All Good'
fi
Report example:
Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 0, CRITICAL: 0)
+------------------------------+---------------------+----------+--------------------------+--------------------------+--------------------------------------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |
+------------------------------+---------------------+----------+--------------------------+--------------------------+--------------------------------------------------------------+
| apt | CVE-2020-3810 | MEDIUM | 1.4.9 | 1.4.10 | Missing input validation in |
| | | | | | the ar/tar implementations of |
| | | | | | APT before version 2.1.2... |
+ +---------------------+----------+ +--------------------------+--------------------------------------------------------------+
| | CVE-2011-3374 | LOW | | | It was found that apt-key |
| | | | | | in apt, all versions, do not |
| | | | | | correctly... |
+------------------------------+---------------------+ +--------------------------+--------------------------+--------------------------------------------------------------+

Answer 1

To return only lines where CRITICAL appears in the column under SEVERITY, try:
awk -F'|' '$4 ~ /CRITICAL/' reports.txt
awk reads input files one line at a time and breaks each line into fields. -F'|' tells awk to use | as the field separator. Consequently, the SEVERITY column is the fourth field and $4 ~ /CRITICAL/ tests to see if that field containst CRITICAL.
Example
Consider this input file (which has one CRITICAL that we want and several that we want to ignore):
$ cat reports.txt
+------------------------------+---------------------+----------+--------------------------+--------------------------+--------------------------------------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |
+------------------------------+---------------------+----------+--------------------------+--------------------------+--------------------------------------------------------------+
| apt-CRITICAL | CVE-2020-3810 | MEDIUM | 1.4.9 | 1.4.10 | Missing input validation in |
| | | | CRITICAL | | the ar/tar implementations of-CRITICAL |
| | | | | | APT before version 2.1.2... |
+ +---------------------+----------+ +--------------------------+--------------------------------------------------------------+
| | CVE-2011-3374 | CRITICAL | | | It was found that apt-key |
| | | | | | in apt, all versions, do not |
| | | | | | correctly... |
+------------------------------+---------------------+----------+--------------------------+--------------------------+--------------------------------------------------------------+
Our command correctly returns only the line with the CRITICAL severity:
$ awk -F'|' '$4 ~ /CRITICAL/' reports.txt
| | CVE-2011-3374 | CRITICAL | | | It was found that apt-key
Use in an if-statement
We can use awk to set the correct exit-code so that it works correctly in an if statement while producing no extraneous output:
if awk -F'|' -v c=1 '$4 ~ /CRITICAL/{c=0; exit} END{exit c}' reports.txt; then