libsoup HTTP Range request excessive memory allocation (DoS)

#!/usr/bin/env bash
# check-cve-2025-32907.sh — libsoup Range-header memory DoS
set -u

VULN=0
UNKNOWN=0
FOUND_PKG=0

echo '== libsoup CVE-2025-32907 check =='

# --- Package version check -------------------------------------------------
if command -v rpm >/dev/null 2>&1; then
  for pkg in libsoup libsoup3; do
    ver=$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' "$pkg" 2>/dev/null | grep -v 'not installed')
    [ -z "$ver" ] && continue
    FOUND_PKG=1
    echo "[pkg] $pkg $ver"
    # RHEL backport tags: el9_5, el9_6, el8_10 with post-April-2025 release strings
    case "$ver" in
      *el9_5*|*el9_6*|*el8_10*|*el10*)
        # Trust distro backport tags
        echo "  -> distro backport tag present, assumed PATCHED" ;;
      *)
        echo "  -> release tag not recognized as post-fix, marking VULNERABLE"
        VULN=1 ;;
    esac
  done
elif command -v dpkg-query >/dev/null 2>&1; then
  for pkg in libsoup2.4-1 libsoup-3.0-0; do
    ver=$(dpkg-query -W -f='${Version}\n' "$pkg" 2>/dev/null)
    [ -z "$ver" ] && continue
    FOUND_PKG=1
    echo "[pkg] $pkg $ver"
    # Debian fixed: libsoup2.4 >= 2.74.3-3+deb12u1 ; libsoup3 >= 3.2.2-2+deb12u1 (approximate)
    case "$pkg" in
      libsoup2.4-1)
        dpkg --compare-versions "$ver" ge '2.74.3-3+deb12u1' || { VULN=1; echo '  -> older than fix, VULNERABLE'; } ;;
      libsoup-3.0-0)
        dpkg --compare-versions "$ver" ge '3.2.2-2+deb12u1'  || { VULN=1; echo '  -> older than fix, VULNERABLE'; } ;;
    esac
  done
else
  echo '[warn] no rpm/dpkg — cannot verify package version'
  UNKNOWN=1
fi

if [ $FOUND_PKG -eq 0 ]; then
  echo '[info] libsoup not installed — NOT AFFECTED'
  exit 0
fi

# --- Server-role check (the only case that actually matters) --------------
echo '== libsoup server-role check =='
SERVERS=0
if command -v lsof >/dev/null 2>&1; then
  while read -r pid; do
    [ -z "$pid" ] && continue
    if lsof -p "$pid" 2>/dev/null | grep -q libsoup; then
      # Listening sockets on this pid?
      if ss -tlnp 2>/dev/null | grep -q "pid=$pid,"; then
        cmd=$(ps -p "$pid" -o comm= 2>/dev/null)
        echo "  [!] pid=$pid ($cmd) linked to libsoup AND listening — HIGH-RELEVANCE target"
        SERVERS=$((SERVERS+1))
      fi
    fi
  done < <(pgrep -a . 2>/dev/null | awk '{print $1}')
fi
[ $SERVERS -eq 0 ] && echo '  no libsoup-linked listening processes found (client-only exposure)'

# --- Verdict ---------------------------------------------------------------
if [ $VULN -eq 1 ]; then
  if [ $SERVERS -gt 0 ]; then
    echo 'RESULT: VULNERABLE (and running as server — patch)'
  else
    echo 'RESULT: VULNERABLE (client-only linkage — low operational risk)'
  fi
  exit 1
fi
if [ $UNKNOWN -eq 1 ]; then echo 'RESULT: UNKNOWN'; exit 2; fi
echo 'RESULT: PATCHED'
exit 0