OpenSSL 1

#!/usr/bin/env python3
# check_cve_2018_0739.py
# Purpose: classify likely exposure to CVE-2018-0739 on the local host.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import shutil
import subprocess
import sys


def run(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        return p.returncode, p.stdout.strip(), p.stderr.strip()
    except Exception as e:
        return 127, "", str(e)


def parse_upstream(ver):
    # Handles forms like 1.0.2n, 1.0.2o-fips, 1.1.0g
    m = re.search(r'(\d+)\.(\d+)\.(\d+)([a-z]?)', ver)
    if not m:
        return None
    major = int(m.group(1))
    minor = int(m.group(2))
    patch = int(m.group(3))
    letter = m.group(4) or ''
    letter_num = ord(letter) - 96 if letter else 0
    return (major, minor, patch, letter_num)


def cmp_tuple(a, b):
    return (a > b) - (a < b)


def upstream_status(openssl_ver):
    t = parse_upstream(openssl_ver)
    if not t:
        return 'UNKNOWN', 'Could not parse OpenSSL version string'

    v_102b = (1, 0, 2, 2)
    v_102n = (1, 0, 2, 14)
    v_102o = (1, 0, 2, 15)
    v_1100 = (1, 1, 0, 0)
    v_110g = (1, 1, 0, 7)
    v_110h = (1, 1, 0, 8)

    if cmp_tuple(t, v_102b) >= 0 and cmp_tuple(t, v_102n) <= 0:
        return 'POTENTIALLY_VULNERABLE', 'Upstream-style version falls in 1.0.2b-1.0.2n'
    if cmp_tuple(t, v_1100) >= 0 and cmp_tuple(t, v_110g) <= 0:
        return 'POTENTIALLY_VULNERABLE', 'Upstream-style version falls in 1.1.0-1.1.0g'
    if cmp_tuple(t, v_102o) >= 0 or cmp_tuple(t, v_110h) >= 0 or t[0] > 1 or (t[0] == 1 and t[1] > 1):
        return 'PATCHED', 'Upstream-style version is at or above fixed release'
    return 'UNKNOWN', 'Version is outside the known affected/fixed ranges or uses unusual packaging'


def ubuntu_backport_check():
    if not shutil.which('dpkg-query'):
        return None

    candidates = ['openssl', 'libssl1.1', 'libssl1.0.2', 'libssl1.0.0']
    installed = {}
    for pkg in candidates:
        rc, out, _ = run(['dpkg-query', '-W', '-f=${Status} ${Version}\n', pkg])
        if rc == 0 and out.startswith('install ok installed '):
            installed[pkg] = out.split()[-1]

    if not installed:
        return None

    # Canonical fixed examples from Ubuntu CVE page
    fixed_thresholds = [
        ('openssl', '1.1.0g-2ubuntu3'),
        ('openssl', '1.0.2g-1ubuntu13.4'),
        ('openssl', '1.0.2g-1ubuntu4.11'),
        ('openssl', '1.0.1f-1ubuntu2.24'),
        ('libssl1.0.2', '1.0.2n-1ubuntu5'),
        ('libssl1.1', '1.1.0g-2ubuntu3'),
    ]

    for pkg, fixed in fixed_thresholds:
        if pkg in installed and shutil.which('dpkg'):
            rc = subprocess.run(['dpkg', '--compare-versions', installed[pkg], 'ge', fixed]).returncode
            if rc == 0:
                return ('PATCHED', f'Debian/Ubuntu package {pkg}={installed[pkg]} is at/above known fixed threshold {fixed}')

    return ('VULNERABLE', 'Debian/Ubuntu package version appears below the known Ubuntu fixed thresholds')


def rpm_backport_check():
    if not shutil.which('rpm'):
        return None

    pkg_names = ['openssl', 'openssl-libs']
    found = []
    for pkg in pkg_names:
        rc, out, _ = run(['rpm', '-q', '--qf', '%{NAME} %{EPOCHNUM}:%{VERSION}-%{RELEASE}\n', pkg])
        if rc == 0 and out:
            found.append(out.strip())

    if not found:
        return None

    # Prefer authoritative comparison if rpmdev-vercmp exists.
    if shutil.which('rpmdev-vercmp'):
        target = '1:1.0.2k-16.el7_6.1'
        for line in found:
            nevra = line.split(None, 1)[1]
            rc, _, _ = run(['rpmdev-vercmp', nevra, target])
            # rpmdev-vercmp returns 0 even when printing relation; parse stdout is inconsistent across versions.
            # Fall back to a conservative exact-match / prefix heuristic if parsing is not available.
        # If rpmdev-vercmp exists but parsing is awkward in a portable script, return UNKNOWN rather than guessing.
        return ('UNKNOWN', 'RPM package found; authoritative version comparison needs local vendor advisory review because backports are common')

    return ('UNKNOWN', 'RPM package found, but safe comparison against backported vendor build levels is not available without distro-specific tooling')


def main():
    if not shutil.which('openssl'):
        print('UNKNOWN: openssl binary not found in PATH')
        sys.exit(2)

    rc, out, err = run(['openssl', 'version'])
    if rc != 0 or not out:
        print(f'UNKNOWN: failed to execute openssl version ({err})')
        sys.exit(2)

    base = out.splitlines()[0]
    status, reason = upstream_status(base)

    if status == 'PATCHED':
        print(f'PATCHED: {base} | {reason}')
        sys.exit(0)

    if status == 'UNKNOWN':
        print(f'UNKNOWN: {base} | {reason}')
        sys.exit(2)

    # Potentially vulnerable upstream version; check common backport-aware package managers.
    deb = ubuntu_backport_check()
    if deb:
        s, r = deb
        print(f'{s}: {base} | {r}')
        sys.exit(0 if s == 'PATCHED' else 1 if s == 'VULNERABLE' else 2)

    rpm = rpm_backport_check()
    if rpm:
        s, r = rpm
        print(f'{s}: {base} | {r}')
        sys.exit(0 if s == 'PATCHED' else 1 if s == 'VULNERABLE' else 2)

    # No package metadata; likely custom or raw upstream install.
    print(f'VULNERABLE: {base} | upstream version is in the affected range and no package-backport evidence was found')
    sys.exit(1)


if __name__ == '__main__':
    main()