CPython ssl module missing denylist for compromised eMudhra intermediate CA keys

#!/usr/bin/env python3
"""CVE-2026-115557 verification: CPython ssl eMudhra SPKI denylist.
Outputs VULNERABLE / PATCHED / UNKNOWN.  Exit: 1=vuln, 0=patched, 2=unknown."""
import sys, ssl, socket

TEST_HOST = "revoked.emudhra.we-have-a-problem.com"
TEST_PORT = 443

def check_certifi():
    try:
        import certifi
        parts = certifi.__version__.split(".")
        y, m = int(parts[0]), int(parts[1])
        d = int(parts[2]) if len(parts) > 2 else 0
        ok = (y > 2026) or (y == 2026 and m > 10) or (y == 2026 and m == 10 and d >= 19)
        return ok, certifi.__version__
    except ImportError:
        return None, "not installed"

def check_trust_store():
    """TLS handshake against disclosure-site test host using system store."""
    ctx = ssl.create_default_context()
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(10)
    wrapped = ctx.wrap_socket(sock, server_hostname=TEST_HOST)
    try:
        wrapped.connect((TEST_HOST, TEST_PORT))
        wrapped.close()
        return "accepted"   # BAD: compromised chain trusted
    except ssl.SSLCertVerificationError:
        return "rejected"   # GOOD: chain rejected
    except ssl.SSLError as e:
        return "rejected" if "CERT_REJECTED" in str(e) else "error"
    except Exception:
        return "error"

def main():
    print("=" * 60)
    print("CVE-2026-115557  CPython ssl eMudhra denylist check")
    print("=" * 60)
    print(f"Python  : {sys.version}")
    print(f"OpenSSL : {ssl.OPENSSL_VERSION}")
    print()

    vuln_flags = []

    # 1 - certifi
    cf_ok, cf_ver = check_certifi()
    tag = "PATCHED" if cf_ok else ("VULNERABLE" if cf_ok is False else "N/A")
    print(f"[1] certifi {cf_ver:>20s}  {tag}")
    if cf_ok is False:
        vuln_flags.append("certifi still trusts emSign root")

    # 2 - system trust store (live TLS test)
    ts = check_trust_store()
    if ts == "accepted":
        print(f"[2] system trust store        VULNERABLE (chain accepted)")
        vuln_flags.append("system trust store accepts compromised chain")
    elif ts == "rejected":
        print(f"[2] system trust store        PATCHED   (chain rejected)")
    else:
        print(f"[2] system trust store        UNKNOWN   (test host unreachable)")

    # 3 - ssl denylist (version heuristic; adjust thresholds as releases ship)
    v = sys.version_info
    denylist = False
    if (v.major, v.minor) == (3, 15) and v.micro >= 2: denylist = True
    if (v.major, v.minor) == (3, 14) and v.micro >= 10: denylist = True
    if (v.major, v.minor) == (3, 13) and v.micro >= 18: denylist = True
    if (v.major, v.minor) >= (3, 16): denylist = True
    tag = "PRESENT" if denylist else "ABSENT"
    print(f"[3] ssl SPKI denylist         {tag}")
    if not denylist:
        vuln_flags.append("ssl SPKI denylist not in this build")

    print()
    if not vuln_flags:
        print("PATCHED")
        sys.exit(0)
    elif ts == "error" and cf_ok is None and not denylist:
        print("UNKNOWN  (could not determine trust-store state)")
        sys.exit(2)
    else:
        print("VULNERABLE")
        for f in vuln_flags:
            print(f"  - {f}")
        sys.exit(1)

if __name__ == "__main__":
    main()