Amazon Redshift JDBC Driver unsafe class loading via JDBC connection URL parameters

#!/usr/bin/env python3
# Check Amazon Redshift JDBC Driver version exposure for CVE-2026-8178
# Usage: python3 check_redshift_jdbc_cve_2026_8178.py <path>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

import os
import re
import sys
import zipfile
from pathlib import Path

TARGET = (2, 2, 2)
NAME_PATTERNS = [
    re.compile(r"redshift-jdbc.*\.jar$", re.I),
    re.compile(r"redshift[-_.]jdbc.*\.jar$", re.I),
]
VERSION_RE = re.compile(r"(\d+)\.(\d+)\.(\d+)(?:\.(\d+))?")


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    parts = [int(x) for x in m.groups() if x is not None]
    return tuple(parts)


def cmp_version(a, b):
    maxlen = max(len(a), len(b))
    a2 = a + (0,) * (maxlen - len(a))
    b2 = b + (0,) * (maxlen - len(b))
    if a2 < b2:
        return -1
    if a2 > b2:
        return 1
    return 0


def read_manifest_version(jar_path):
    try:
        with zipfile.ZipFile(jar_path, 'r') as zf:
            candidates = [
                'META-INF/MANIFEST.MF',
                'META-INF/maven/com.amazon.redshift/redshift-jdbc42/pom.properties',
                'META-INF/maven/com.amazon.redshift/Redshift-Jdbc42/pom.properties',
            ]
            for name in candidates:
                try:
                    data = zf.read(name).decode('utf-8', errors='ignore')
                except KeyError:
                    continue
                for line in data.splitlines():
                    if line.lower().startswith('implementation-version:'):
                        return line.split(':', 1)[1].strip()
                    if line.lower().startswith('bundle-version:'):
                        return line.split(':', 1)[1].strip()
                    if line.lower().startswith('specification-version:'):
                        return line.split(':', 1)[1].strip()
                    if line.lower().startswith('version='):
                        return line.split('=', 1)[1].strip()
    except Exception:
        return None
    return None


def is_candidate(path):
    name = path.name
    return any(p.search(name) for p in NAME_PATTERNS)


def find_jars(root):
    p = Path(root)
    if not p.exists():
        return []
    if p.is_file() and p.suffix.lower() == '.jar':
        return [p] if is_candidate(p) else []
    jars = []
    for dirpath, _, filenames in os.walk(p):
        for fn in filenames:
            full = Path(dirpath) / fn
            if full.suffix.lower() == '.jar' and is_candidate(full):
                jars.append(full)
    return jars


def evaluate(jar):
    vtext = read_manifest_version(jar) or jar.name
    version = parse_version(vtext)
    if version is None:
        return ('UNKNOWN', str(jar), None)
    if cmp_version(version, TARGET) < 0:
        return ('VULNERABLE', str(jar), '.'.join(map(str, version)))
    return ('PATCHED', str(jar), '.'.join(map(str, version)))


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_redshift_jdbc_cve_2026_8178.py <path>')
        sys.exit(3)

    target = sys.argv[1]
    jars = find_jars(target)
    if not jars:
        print('UNKNOWN - no Amazon Redshift JDBC JARs found')
        sys.exit(2)

    results = [evaluate(j) for j in jars]

    vuln = [r for r in results if r[0] == 'VULNERABLE']
    patched = [r for r in results if r[0] == 'PATCHED']
    unknown = [r for r in results if r[0] == 'UNKNOWN']

    if vuln:
        details = '; '.join([f"{path} version={ver}" for _, path, ver in vuln])
        print(f'VULNERABLE - CVE-2026-8178 exposure detected: {details}')
        sys.exit(1)

    if patched and not unknown:
        details = '; '.join([f"{path} version={ver}" for _, path, ver in patched])
        print(f'PATCHED - all detected Redshift JDBC JARs are >= 2.2.2: {details}')
        sys.exit(0)

    details = '; '.join([f"{path}" for _, path, _ in unknown])
    if patched:
        details = details + '; ' + '; '.join([f"patched={path} version={ver}" for _, path, ver in patched])
    print(f'UNKNOWN - some candidate JARs could not be versioned: {details}')
    sys.exit(2)


if __name__ == '__main__':
    main()