Undisclosed vulnerability reserved as CVE-2020-22343 with no public product attribution

#!/usr/bin/env python3
# verify_cve_2020_22343.py
#
# Purpose:
#   Check an exported scanner/inventory CSV for explicit mentions of CVE-2020-22343.
#   Because no authoritative product mapping or fixed version is publicly available,
#   this script cannot inspect hosts directly. It reports:
#     VULNERABLE - if the CSV explicitly lists CVE-2020-22343 as open/present
#     PATCHED    - if the CSV explicitly lists CVE-2020-22343 as fixed/patched/remediated
#     UNKNOWN    - if the CSV contains no trustworthy mention of the exact CVE
#
# Expected CSV columns (case-insensitive, any subset is fine):
#   cve, finding, title, plugin_name, vulnerability, status, remediation_status
#
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / insufficient data
#   3 = usage or file error

import csv
import os
import re
import sys

TARGET = 'CVE-2020-22343'
OPEN_WORDS = {'open', 'active', 'present', 'detected', 'unfixed', 'vulnerable', 'affected'}
FIXED_WORDS = {'fixed', 'patched', 'remediated', 'closed', 'resolved', 'mitigated'}


def norm(s):
    return (s or '').strip().lower()


def row_text(row):
    return ' '.join(str(v) for v in row.values() if v is not None)


def classify_status(row):
    status_fields = []
    for k, v in row.items():
        lk = norm(k)
        if lk in {'status', 'remediation_status', 'state', 'finding_status'}:
            status_fields.append(norm(v))
    combined = ' '.join(status_fields)
    if any(w in combined for w in FIXED_WORDS):
        return 'PATCHED'
    if any(w in combined for w in OPEN_WORDS):
        return 'VULNERABLE'
    return None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN')
        print('Usage: python3 verify_cve_2020_22343.py <findings.csv>', file=sys.stderr)
        sys.exit(3)

    path = sys.argv[1]
    if not os.path.isfile(path):
        print('UNKNOWN')
        print(f'File not found: {path}', file=sys.stderr)
        sys.exit(3)

    exact_hits = []

    try:
        with open(path, 'r', encoding='utf-8-sig', newline='') as f:
            reader = csv.DictReader(f)
            if not reader.fieldnames:
                print('UNKNOWN')
                print('CSV has no header row', file=sys.stderr)
                sys.exit(3)

            for row in reader:
                text = row_text(row)
                if TARGET.lower() in text.lower():
                    exact_hits.append(row)
    except Exception as e:
        print('UNKNOWN')
        print(f'Error reading CSV: {e}', file=sys.stderr)
        sys.exit(3)

    if not exact_hits:
        print('UNKNOWN')
        sys.exit(2)

    # If any explicit row says open, prefer VULNERABLE.
    for row in exact_hits:
        state = classify_status(row)
        if state == 'VULNERABLE':
            print('VULNERABLE')
            sys.exit(1)

    # If all explicit rows are fixed/patched, report PATCHED.
    states = [classify_status(r) for r in exact_hits]
    if states and all(s == 'PATCHED' for s in states if s is not None) and any(s == 'PATCHED' for s in states):
        print('PATCHED')
        sys.exit(0)

    print('UNKNOWN')
    sys.exit(2)


if __name__ == '__main__':
    main()