Go crypto/x509 failure to distrust compromised eMudhra intermediate CA certificates with trivially weak keys

#!/usr/bin/env bash
# CVE-2026-111943 — eMudhra compromised intermediate CA denylist check
# Checks: (1) Go toolchain version, (2) OS ca-certificates, (3) Go binary build versions
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
vulnerable=0
checks_run=0

echo "=== CVE-2026-111943 Check: eMudhra Intermediate CA Denylist ==="
echo ""

# --- Check 1: Go toolchain version ---
echo "[Check 1] Go toolchain version"
if command -v go &>/dev/null; then
  GO_VERSION=$(go version | grep -oP 'go[0-9]+\.[0-9]+\.?[0-9]*')
  GO_MAJOR=$(echo "$GO_VERSION" | grep -oP '[0-9]+' | head -1)
  GO_MINOR=$(echo "$GO_VERSION" | grep -oP '[0-9]+' | sed -n '2p')
  GO_PATCH=$(echo "$GO_VERSION" | grep -oP '[0-9]+' | sed -n '3p')
  GO_PATCH=${GO_PATCH:-0}
  checks_run=$((checks_run + 1))
  if [[ "$GO_MINOR" -eq 26 && "$GO_PATCH" -ge 10 ]] || \
     [[ "$GO_MINOR" -eq 27 && "$GO_PATCH" -ge 3 ]] || \
     [[ "$GO_MINOR" -gt 27 ]]; then
    echo -e "  ${GREEN}PATCHED${NC}: $GO_VERSION (>= 1.26.10 or >= 1.27.3)"
  else
    echo -e "  ${RED}VULNERABLE${NC}: $GO_VERSION (needs >= 1.26.10 or >= 1.27.3)"
    vulnerable=1
  fi
else
  echo -e "  ${YELLOW}SKIPPED${NC}: go not found in PATH"
fi

echo ""

# --- Check 2: OS trust store — look for eMudhra intermediates ---
echo "[Check 2] OS trust store (eMudhra intermediate presence)"
# Known compromised intermediate CN fragments
EMUDHRA_PATTERNS=("EM DV TLS CA" "EM OV TLS CA" "EM EV TLS CA" "EM OV CS CA")
found_emudhra=0

if [[ -f /etc/ssl/certs/ca-certificates.crt ]]; then
  CERT_BUNDLE="/etc/ssl/certs/ca-certificates.crt"
elif [[ -f /etc/pki/tls/certs/ca-bundle.crt ]]; then
  CERT_BUNDLE="/etc/pki/tls/certs/ca-bundle.crt"
elif [[ -f /etc/ssl/cert.pem ]]; then
  CERT_BUNDLE="/etc/ssl/cert.pem"
else
  CERT_BUNDLE=""
fi

if [[ -n "$CERT_BUNDLE" ]]; then
  checks_run=$((checks_run + 1))
  for pattern in "${EMUDHRA_PATTERNS[@]}"; do
    if grep -qi "$pattern" "$CERT_BUNDLE" 2>/dev/null; then
      echo -e "  ${RED}VULNERABLE${NC}: Found '$pattern' in $CERT_BUNDLE"
      found_emudhra=1
      vulnerable=1
    fi
  done
  if [[ $found_emudhra -eq 0 ]]; then
    echo -e "  ${GREEN}PATCHED${NC}: No compromised eMudhra intermediates in $CERT_BUNDLE"
  fi
else
  echo -e "  ${YELLOW}SKIPPED${NC}: Could not locate system CA bundle"
fi

echo ""

# --- Check 3: Scan for Go binaries built with vulnerable versions ---
echo "[Check 3] Scanning for Go binaries built with vulnerable Go versions"
echo "  (scanning common paths — may take a moment)"
vuln_binaries=0
SCAN_PATHS=(/usr/local/bin /usr/bin /opt /srv /home)
for spath in "${SCAN_PATHS[@]}"; do
  [[ -d "$spath" ]] || continue
  while IFS= read -r -d '' binary; do
    # Extract Go build version from binary
    build_ver=$(strings "$binary" 2>/dev/null | grep -oP '^go1\.[0-9]+\.?[0-9]*$' | head -1 || true)
    if [[ -n "$build_ver" ]]; then
      b_minor=$(echo "$build_ver" | grep -oP '[0-9]+' | sed -n '2p')
      b_patch=$(echo "$build_ver" | grep -oP '[0-9]+' | sed -n '3p')
      b_patch=${b_patch:-0}
      if [[ "$b_minor" -eq 26 && "$b_patch" -lt 10 ]] || \
         [[ "$b_minor" -eq 27 && "$b_patch" -lt 3 ]] || \
         [[ "$b_minor" -lt 26 ]]; then
        echo -e "  ${RED}VULNERABLE${NC}: $binary (built with $build_ver)"
        vuln_binaries=$((vuln_binaries + 1))
        vulnerable=1
      fi
    fi
  done < <(find "$spath" -type f -executable -print0 2>/dev/null)
done
checks_run=$((checks_run + 1))
if [[ $vuln_binaries -eq 0 ]]; then
  echo -e "  ${GREEN}PATCHED${NC}: No vulnerable Go binaries found in scanned paths"
else
  echo -e "  ${RED}FOUND${NC}: $vuln_binaries Go binary(ies) built with vulnerable Go versions"
fi

echo ""
echo "========================================"
if [[ $checks_run -eq 0 ]]; then
  echo -e "Result: ${YELLOW}UNKNOWN${NC} — no checks could be performed"
  exit 2
elif [[ $vulnerable -gt 0 ]]; then
  echo -e "Result: ${RED}VULNERABLE${NC} — action required (see CVE-2026-111943)"
  exit 1
else
  echo -e "Result: ${GREEN}PATCHED${NC} — system appears protected"
  exit 0
fi