Mbed TLS 3

#!/usr/bin/env python3
# check_cve_2026_34876.py
# Detect likely exposure to CVE-2026-34876 (Mbed TLS 3.1.0 through 3.6.5)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple

VULN_MIN = (3, 1, 0)
VULN_MAX_EXCL = (3, 6, 6)


def normalize_version(raw: str) -> Optional[Tuple[int, int, int]]:
    if not raw:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', raw)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def classify(ver: Tuple[int, int, int]) -> str:
    if VULN_MIN <= ver < VULN_MAX_EXCL:
        return 'VULNERABLE'
    if ver >= (4, 0, 0):
        return 'PATCHED'
    if ver < VULN_MIN:
        return 'PATCHED'
    return 'UNKNOWN'


def run(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip()
    except Exception:
        pass
    return ''


def try_pkg_config() -> Optional[str]:
    if shutil.which('pkg-config'):
        for name in ('mbedtls', 'mbedtls3', 'libmbedtls'):
            out = run(['pkg-config', '--modversion', name])
            if out:
                return out
    return None


def try_dpkg() -> Optional[str]:
    if shutil.which('dpkg-query'):
        pkgs = ['libmbedtls-dev', 'libmbedtls14', 'libmbedtls', 'mbedtls']
        for pkg in pkgs:
            out = run(['dpkg-query', '-W', '-f=${Version}', pkg])
            if out:
                return out
    return None


def try_rpm() -> Optional[str]:
    if shutil.which('rpm'):
        for pkg in ('mbedtls', 'mbedtls-devel', 'libmbedtls'):
            out = run(['rpm', '-q', '--qf', '%{VERSION}-%{RELEASE}', pkg])
            if out and 'not installed' not in out.lower():
                return out
    return None


def try_apk() -> Optional[str]:
    if shutil.which('apk'):
        out = run(['apk', 'info', '-e', 'mbedtls'])
        if out:
            out2 = run(['apk', 'info', '-v', 'mbedtls'])
            return out2 or out
    return None


def try_pacman() -> Optional[str]:
    if shutil.which('pacman'):
        out = run(['pacman', '-Q', 'mbedtls'])
        if out:
            return out
    return None


def try_brew() -> Optional[str]:
    if shutil.which('brew'):
        out = run(['brew', 'list', '--versions', 'mbedtls'])
        if out:
            return out
    return None


def try_strings(path: str) -> Optional[str]:
    if not path or not os.path.exists(path):
        return None
    if shutil.which('strings'):
        out = run(['strings', '-a', path])
        if out:
            for line in out.splitlines():
                if 'mbed TLS ' in line or 'Mbed TLS ' in line or 'mbedtls-' in line:
                    m = re.search(r'(\d+\.\d+\.\d+)', line)
                    if m:
                        return m.group(1)
    return None


def guess_library_paths():
    paths = []
    sysname = platform.system().lower()
    if sysname == 'linux':
        paths.extend([
            '/usr/lib/libmbedcrypto.so',
            '/usr/lib64/libmbedcrypto.so',
            '/usr/lib/x86_64-linux-gnu/libmbedcrypto.so',
            '/usr/local/lib/libmbedcrypto.so',
            '/lib/x86_64-linux-gnu/libmbedcrypto.so',
        ])
    elif sysname == 'darwin':
        paths.extend([
            '/opt/homebrew/lib/libmbedcrypto.dylib',
            '/usr/local/lib/libmbedcrypto.dylib',
        ])
    elif sysname == 'windows':
        paths.extend([
            r'C:\\Program Files\\Mbed TLS\\libmbedcrypto.dll',
            r'C:\\mbedtls\\libmbedcrypto.dll',
        ])
    return [p for p in paths if os.path.exists(p)]


def main():
    parser = argparse.ArgumentParser(description='Check likely exposure to CVE-2026-34876')
    parser.add_argument('--version', help='Explicit Mbed TLS version to evaluate, e.g. 3.6.5')
    parser.add_argument('--path', help='Path to libmbedcrypto library/binary to inspect with strings')
    args = parser.parse_args()

    evidence = []

    if args.version:
        evidence.append(('explicit', args.version))

    if args.path:
        v = try_strings(args.path)
        if v:
            evidence.append((args.path, v))

    for label, func in [
        ('pkg-config', try_pkg_config),
        ('dpkg', try_dpkg),
        ('rpm', try_rpm),
        ('apk', try_apk),
        ('pacman', try_pacman),
        ('brew', try_brew),
    ]:
        v = func()
        if v:
            evidence.append((label, v))

    for p in guess_library_paths():
        v = try_strings(p)
        if v:
            evidence.append((p, v))

    seen = []
    for src, raw in evidence:
        ver = normalize_version(raw)
        if ver:
            seen.append((src, raw, ver, classify(ver)))

    if not seen:
        print('UNKNOWN - could not determine installed Mbed TLS version or library path')
        sys.exit(2)

    # Prefer any vulnerable finding over patched, because fleets often have multiple copies.
    vuln = [x for x in seen if x[3] == 'VULNERABLE']
    if vuln:
        src, raw, ver, state = vuln[0]
        print(f'VULNERABLE - detected Mbed TLS {ver[0]}.{ver[1]}.{ver[2]} from {src} ({raw})')
        sys.exit(1)

    patched = [x for x in seen if x[3] == 'PATCHED']
    if patched:
        src, raw, ver, state = patched[0]
        print(f'PATCHED - detected Mbed TLS {ver[0]}.{ver[1]}.{ver[2]} from {src} ({raw})')
        sys.exit(0)

    print('UNKNOWN - version detected but could not classify confidently')
    sys.exit(2)


if __name__ == '__main__':
    main()