OpenSSL X.509 policy constraints verification excessive resource consumption denial of service

#!/usr/bin/env bash
# CVE-2023-0464 OpenSSL local exposure check
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

result="UNKNOWN"
reason="Could not determine package/version state"

have_cmd() { command -v "$1" >/dev/null 2>&1; }

ver_ge() {
  # returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

check_upstream_openssl() {
  local v
  v=$(openssl version 2>/dev/null | awk '{print $2}') || return 1
  case "$v" in
    3.1.*)
      if ver_ge "$v" "3.1.1"; then result="PATCHED"; reason="Upstream OpenSSL $v >= 3.1.1"; return 0; else result="VULNERABLE"; reason="Upstream OpenSSL $v < 3.1.1"; return 0; fi ;;
    3.0.*)
      if ver_ge "$v" "3.0.9"; then result="PATCHED"; reason="Upstream OpenSSL $v >= 3.0.9"; return 0; else result="VULNERABLE"; reason="Upstream OpenSSL $v < 3.0.9"; return 0; fi ;;
    1.1.1*)
      local suffix
      suffix=${v#1.1.1}
      if [[ -z "$suffix" ]]; then result="VULNERABLE"; reason="Upstream OpenSSL 1.1.1 baseline is older than 1.1.1u"; return 0; fi
      local letter=${suffix:0:1}
      if [[ "$letter" =~ [u-z] ]]; then result="PATCHED"; reason="Upstream OpenSSL $v >= 1.1.1u"; else result="VULNERABLE"; reason="Upstream OpenSSL $v < 1.1.1u"; fi
      return 0 ;;
    1.0.2*)
      local suffix
      suffix=${v#1.0.2}
      if [[ "$suffix" == zh* ]]; then result="PATCHED"; reason="Upstream OpenSSL $v >= 1.0.2zh"; else result="VULNERABLE"; reason="Upstream OpenSSL $v < 1.0.2zh"; fi
      return 0 ;;
  esac
  return 1
}

check_dpkg() {
  local pkgver osrel
  pkgver=$(dpkg-query -W -f='${Version}' openssl 2>/dev/null) || return 1
  osrel=$(grep '^VERSION_CODENAME=' /etc/os-release 2>/dev/null | cut -d= -f2 | tr -d '"')
  case "$osrel" in
    jammy)
      if dpkg --compare-versions "$pkgver" ge "3.0.2-0ubuntu1.9"; then result="PATCHED"; reason="Ubuntu jammy openssl $pkgver includes fix"; else result="VULNERABLE"; reason="Ubuntu jammy openssl $pkgver older than fixed 3.0.2-0ubuntu1.9"; fi ;;
    focal)
      if dpkg --compare-versions "$pkgver" ge "1.1.1f-1ubuntu2.18"; then result="PATCHED"; reason="Ubuntu focal openssl $pkgver includes fix"; else result="VULNERABLE"; reason="Ubuntu focal openssl $pkgver older than fixed 1.1.1f-1ubuntu2.18"; fi ;;
    bionic)
      if dpkg --compare-versions "$pkgver" ge "1.1.1-1ubuntu2.1~18.04.22"; then result="PATCHED"; reason="Ubuntu bionic openssl $pkgver includes fix"; else result="VULNERABLE"; reason="Ubuntu bionic openssl $pkgver older than fixed 1.1.1-1ubuntu2.1~18.04.22"; fi ;;
    bullseye)
      if dpkg --compare-versions "$pkgver" ge "1.1.1n-0+deb11u5"; then result="PATCHED"; reason="Debian bullseye openssl $pkgver includes fix"; else result="VULNERABLE"; reason="Debian bullseye openssl $pkgver older than fixed 1.1.1n-0+deb11u5"; fi ;;
    *)
      return 1 ;;
  esac
  return 0
}

check_rpm() {
  local pkgver
  pkgver=$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' openssl 2>/dev/null) || return 1
  # RHEL/SUSE often backport fixes without obvious upstream-style version jumps.
  # If rpm-based and package metadata is present, prefer errata-driven validation by your scanner/SBOM.
  result="UNKNOWN"
  reason="RPM package found ($pkgver). Verify against vendor errata/backports; version string alone may be misleading."
  return 0
}

if have_cmd dpkg-query && check_dpkg; then
  :
elif have_cmd rpm && check_rpm; then
  :
elif have_cmd openssl && check_upstream_openssl; then
  :
fi

printf '%s - %s\n' "$result" "$reason"
case "$result" in
  PATCHED) exit 0 ;;
  VULNERABLE) exit 1 ;;
  *) exit 2 ;;
esac