Mbed TLS versions from 2

#!/usr/bin/env python3
# check_cve_2026_34877.py
# Determine likely exposure to CVE-2026-34877.
# Exit codes:
#   0 = PATCHED / not in affected version range
#   1 = VULNERABLE (affected version and serialization API usage found)
#   2 = UNKNOWN (affected version but usage not proven or version unreadable)

import argparse
import os
import re
import sys
from typing import Optional, Tuple

AFFECTED_MIN = (2, 19, 0)
FIXED_3X = (3, 6, 6)
AFFECTED_4X_ONLY = (4, 0, 0)
FIXED_4X = (4, 1, 0)

API_PATTERNS = [
    r"mbedtls_ssl_session_save\s*\(",
    r"mbedtls_ssl_session_load\s*\(",
    r"mbedtls_ssl_context_save\s*\(",
    r"mbedtls_ssl_context_load\s*\(",
    r"mbedtls_ssl_session_reset_int\s*\(",
]

TEXT_EXTS = {".c", ".h", ".cc", ".cpp", ".cxx", ".hpp", ".hh", ".ipp", ".py", ".txt", ".md", ".cmake", "", ".mk"}


def parse_version(v: str) -> Optional[Tuple[int, int, int]]:
    m = re.match(r"^\s*(\d+)\.(\d+)\.(\d+)\s*$", v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def is_affected(ver: Tuple[int, int, int]) -> bool:
    if ver == AFFECTED_4X_ONLY:
        return True
    if ver < AFFECTED_MIN:
        return False
    if ver[0] == 2:
        return True
    if ver[0] == 3 and ver < FIXED_3X:
        return True
    if ver[0] == 4 and ver < FIXED_4X:
        return True
    return False


def is_patched(ver: Tuple[int, int, int]) -> bool:
    if ver[0] == 3 and ver >= FIXED_3X:
        return True
    if ver[0] == 4 and ver >= FIXED_4X:
        return True
    return False


def looks_text_file(path: str) -> bool:
    _, ext = os.path.splitext(path)
    return ext.lower() in TEXT_EXTS


def scan_source_tree(root: str):
    hits = []
    regexes = [re.compile(p) for p in API_PATTERNS]
    for base, _, files in os.walk(root):
        for name in files:
            path = os.path.join(base, name)
            if not looks_text_file(path):
                continue
            try:
                with open(path, "r", encoding="utf-8", errors="ignore") as f:
                    for lineno, line in enumerate(f, 1):
                        for rx in regexes:
                            if rx.search(line):
                                hits.append((path, lineno, line.strip()))
                                break
            except Exception:
                continue
    return hits


def main():
    ap = argparse.ArgumentParser(description="Check likely exposure to CVE-2026-34877")
    ap.add_argument("--version", required=True, help="Mbed TLS version, e.g. 3.6.5")
    ap.add_argument("--source", help="Path to source tree or unpacked artifact to scan for serialization API usage")
    args = ap.parse_args()

    ver = parse_version(args.version)
    if ver is None:
        print("UNKNOWN - could not parse version; expected format X.Y.Z")
        sys.exit(2)

    if is_patched(ver) or not is_affected(ver):
        print(f"PATCHED - version {args.version} is outside the affected range for CVE-2026-34877")
        sys.exit(0)

    if not args.source:
        print(f"UNKNOWN - version {args.version} is in the affected range, but serialization API usage was not assessed")
        sys.exit(2)

    if not os.path.isdir(args.source):
        print(f"UNKNOWN - source path not found or not a directory: {args.source}")
        sys.exit(2)

    hits = scan_source_tree(args.source)
    if hits:
        print(f"VULNERABLE - version {args.version} is affected and serialization API usage was found")
        for path, lineno, line in hits[:20]:
            print(f"HIT {path}:{lineno}: {line}")
        if len(hits) > 20:
            print(f"... {len(hits) - 20} additional hit(s) omitted")
        sys.exit(1)

    print(f"UNKNOWN - version {args.version} is affected, but no direct serialization API references were found in {args.source}")
    print("UNKNOWN means review wrappers, third-party modules, and binary-only components before closing.")
    sys.exit(2)


if __name__ == "__main__":
    main()