PJSIP is a free and open source multimedia communication library written in C

#!/usr/bin/env python3
# verify_pjsip_cve_2026_28799.py
# Checks whether a host appears to have PJSIP/pjproject older than 2.17.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import glob
import shutil
import subprocess

THRESHOLD = (2, 17)


def run(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        return p.returncode, (p.stdout or '').strip(), (p.stderr or '').strip()
    except Exception:
        return 127, '', 'execution failed'


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)(?:\.(\d+))?', text)
    if not m:
        return None
    major = int(m.group(1))
    minor = int(m.group(2))
    patch = int(m.group(3) or 0)
    return (major, minor, patch)


def is_patched(ver):
    if ver is None:
        return None
    major, minor, patch = ver
    return (major, minor) >= THRESHOLD


def read_file(path):
    try:
        with open(path, 'r', encoding='utf-8', errors='ignore') as f:
            return f.read()
    except Exception:
        return ''


def check_pkg_config():
    if not shutil.which('pkg-config'):
        return None, 'pkg-config not found'
    for pkg in ('libpjproject', 'pjproject', 'libpjsip', 'pjsip'):
        rc, out, err = run(['pkg-config', '--modversion', pkg])
        if rc == 0 and out:
            ver = parse_version(out)
            return ver, f'pkg-config:{pkg}={out}'
    return None, 'pkg-config package not found'


def check_pjsua_binary():
    for bin_name in ('pjsua', 'pjsystest'):
        path = shutil.which(bin_name)
        if not path:
            continue
        rc, out, err = run([path, '--version'])
        text = '\n'.join(x for x in (out, err) if x)
        ver = parse_version(text)
        if ver:
            return ver, f'binary:{bin_name}={text}'
    return None, 'no pjsua-style binary version found'


def check_header_files():
    candidates = [
        '/usr/include/pj/version.h',
        '/usr/local/include/pj/version.h',
    ]
    candidates.extend(glob.glob('/opt/**/pj/version.h', recursive=True))
    for path in candidates:
        if not os.path.isfile(path):
            continue
        data = read_file(path)
        maj = re.search(r'#define\s+PJ_VERSION_NUM_MAJOR\s+(\d+)', data)
        mino = re.search(r'#define\s+PJ_VERSION_NUM_MINOR\s+(\d+)', data)
        patch = re.search(r'#define\s+PJ_VERSION_NUM_REV\s+(\d+)', data)
        if maj and mino:
            ver = (int(maj.group(1)), int(mino.group(1)), int(patch.group(1)) if patch else 0)
            return ver, f'header:{path}'
    return None, 'no pj/version.h found'


def check_dpkg():
    if not shutil.which('dpkg-query'):
        return None, 'dpkg-query not found'
    for pkg in ('pjproject', 'libpjproject-dev', 'libpjproject2', 'libpjsip-ua2'):
        rc, out, err = run(['dpkg-query', '-W', '-f=${Version}', pkg])
        if rc == 0 and out and 'no packages found' not in out.lower():
            ver = parse_version(out)
            return ver, f'dpkg:{pkg}={out}'
    return None, 'dpkg package not found'


def check_rpm():
    if not shutil.which('rpm'):
        return None, 'rpm not found'
    for pkg in ('pjproject', 'pjproject-devel', 'pjsip'):
        rc, out, err = run(['rpm', '-q', '--qf', '%{VERSION}-%{RELEASE}', pkg])
        if rc == 0 and out and 'is not installed' not in out.lower():
            ver = parse_version(out)
            return ver, f'rpm:{pkg}={out}'
    return None, 'rpm package not found'


def main():
    checks = [check_pkg_config, check_pjsua_binary, check_header_files, check_dpkg, check_rpm]
    evidence = []
    results = []

    for check in checks:
        ver, note = check()
        evidence.append(note)
        if ver is not None:
            results.append((ver, note, is_patched(ver)))

    # Prefer any direct version evidence we found.
    if results:
        # Sort by version tuple descending just for stable display.
        results.sort(key=lambda x: x[0], reverse=True)
        # If any found version is < 2.17, call it vulnerable unless another check proves the actually loaded/app-bundled copy is newer.
        vulnerable = [r for r in results if r[2] is False]
        patched = [r for r in results if r[2] is True]

        if vulnerable:
            ver, note, _ = vulnerable[0]
            print(f'VULNERABLE - found PJSIP/pjproject version {ver[0]}.{ver[1]}.{ver[2]} via {note}')
            sys.exit(1)
        if patched:
            ver, note, _ = patched[0]
            print(f'PATCHED - found PJSIP/pjproject version {ver[0]}.{ver[1]}.{ver[2]} via {note}')
            sys.exit(0)

    print('UNKNOWN - could not identify an installed PJSIP/pjproject version; inspect application-bundled libraries, SBOM, or build manifests')
    sys.exit(2)


if __name__ == '__main__':
    main()