Oracle Java SE JSSE pre-auth remote data confidentiality and integrity compromise

#!/usr/bin/env bash
# CVE-2026-91403 - Oracle Java SE JSSE Vulnerability Checker
# Compares installed Java version against known affected and expected fixed versions.
# All currently released Java SE versions are affected; patched versions expected
# in Oracle emergency patch or January 2027 CPU.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -uo pipefail

JAVA_CMD=""
if command -v java &>/dev/null; then
  JAVA_CMD="java"
elif [ -n "${JAVA_HOME:-}" ] && [ -x "$JAVA_HOME/bin/java" ]; then
  JAVA_CMD="$JAVA_HOME/bin/java"
fi

if [ -z "$JAVA_CMD" ]; then
  echo "UNKNOWN - No Java installation found on this host."
  exit 2
fi

RAW=$($JAVA_CMD -version 2>&1 | head -1)
VER=$(echo "$RAW" | sed -E 's/.*"([^"]+)".*/\1/')
echo "Detected: $RAW"
echo "Parsed version: $VER"

# Determine major version
if [[ "$VER" =~ ^1\.([0-9]+)\. ]]; then
  MAJOR="${BASH_REMATCH[1]}"
elif [[ "$VER" =~ ^([0-9]+)\. ]]; then
  MAJOR="${BASH_REMATCH[1]}"
else
  echo "UNKNOWN - Cannot parse major version from: $VER"
  exit 2
fi

# Fixed version thresholds (expected Jan 2027 CPU or emergency patch)
# Java 8: 8u521+  |  Java 11: 11.0.34+  |  Java 17: 17.0.22+
# Java 21: 21.0.14+ | Java 25: 25.0.6+  |  Java 27: 27.0.2+
case "$MAJOR" in
  8)
    UPDATE=$(echo "$VER" | sed -E 's/.*_([0-9]+).*/\1/')
    if ! [[ "$UPDATE" =~ ^[0-9]+$ ]]; then
      echo "UNKNOWN - Cannot parse Java 8 update from: $VER"
      exit 2
    fi
    if [ "$UPDATE" -ge 521 ]; then
      echo "PATCHED - Java 8u${UPDATE} is at or above expected fix (8u521)."
      exit 0
    else
      echo "VULNERABLE - Java 8u${UPDATE} is affected by CVE-2026-91403 (JSSE)."
      exit 1
    fi
    ;;
  11|17|21|25|27)
    PATCH=$(echo "$VER" | cut -d. -f3 | sed 's/[^0-9].*//')
    if ! [[ "$PATCH" =~ ^[0-9]+$ ]]; then
      echo "UNKNOWN - Cannot parse patch level from: $VER"
      exit 2
    fi
    declare -A FIX_THRESHOLDS=( [11]=34 [17]=22 [21]=14 [25]=6 [27]=2 )
    THRESHOLD=${FIX_THRESHOLDS[$MAJOR]}
    if [ "$PATCH" -ge "$THRESHOLD" ]; then
      echo "PATCHED - Java ${MAJOR}.0.${PATCH} is at or above expected fix (${MAJOR}.0.${THRESHOLD})."
      exit 0
    else
      echo "VULNERABLE - Java ${MAJOR}.0.${PATCH} is affected by CVE-2026-91403 (JSSE)."
      exit 1
    fi
    ;;
  *)
    echo "UNKNOWN - Java ${MAJOR} is outside the known affected version matrix."
    echo "Check Oracle Security Alert CVE-2026-91403 for coverage."
    exit 2
    ;;
esac