nginx Data Disclosure Vulnerability

#!/usr/bin/env bash
# check-cve-2017-7529.sh
# Determine likely exposure to NGINX CVE-2017-7529 on a Linux host.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 3=UNKNOWN

set -u

BIN="${1:-nginx}"

say() { printf '%s\n' "$*"; }

ver_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

ver_lt() {
  # returns 0 if $1 < $2
  ! ver_ge "$1" "$2"
}

if ! command -v "$BIN" >/dev/null 2>&1; then
  say "UNKNOWN: nginx binary not found: $BIN"
  exit 3
fi

raw_ver="$($BIN -v 2>&1 | sed -n 's#.*nginx/\([^ ]*\).*#\1#p')"
up_ver="$(printf '%s' "$raw_ver" | grep -oE '[0-9]+(\.[0-9]+){1,2}' | head -n1)"

if [ -z "$up_ver" ]; then
  say "UNKNOWN: could not parse nginx version from: $raw_ver"
  exit 3
fi

# 1) Debian / Ubuntu package checks (prefer distro backports over upstream-string logic)
if command -v dpkg-query >/dev/null 2>&1 && command -v dpkg >/dev/null 2>&1; then
  for pkg in nginx nginx-core nginx-full nginx-light nginx-extras; do
    pkgver="$(dpkg-query -W -f='${Version}' "$pkg" 2>/dev/null)"
    if [ -n "$pkgver" ]; then
      # Debian fixed versions
      if dpkg --compare-versions "$pkgver" ge "1.22.1-9+deb12u7" || \
         dpkg --compare-versions "$pkgver" ge "1.18.0-6.1+deb11u6" || \
         dpkg --compare-versions "$pkgver" ge "1.10.3-1+deb9u1" || \
         dpkg --compare-versions "$pkgver" ge "1.6.2-5+deb8u5" || \
         dpkg --compare-versions "$pkgver" ge "1.2.1-2.2+wheezy4+deb7u1"; then
        say "PATCHED: Debian-family package $pkg version $pkgver includes a fixed build for CVE-2017-7529"
        exit 0
      fi

      # Ubuntu fixed versions from vendor advisories
      if dpkg --compare-versions "$pkgver" ge "1.10.3-1ubuntu3.1" || \
         dpkg --compare-versions "$pkgver" ge "1.10.3-0ubuntu0.16.04.2" || \
         dpkg --compare-versions "$pkgver" ge "1.10.1-0ubuntu1.3" || \
         dpkg --compare-versions "$pkgver" ge "1.4.6-1ubuntu3.8"; then
        say "PATCHED: Ubuntu-family package $pkg version $pkgver includes a fixed build for CVE-2017-7529"
        exit 0
      fi

      # If package exists but is older than known fixed distro versions, fall through to upstream logic.
      break
    fi
  done
fi

# 2) RPM-family package checks: changelog is the safest generic backport signal
if command -v rpm >/dev/null 2>&1; then
  for pkg in nginx nginx-core nginx-all-modules rh-nginx110-nginx; do
    if rpm -q "$pkg" >/dev/null 2>&1; then
      if rpm -q --changelog "$pkg" 2>/dev/null | grep -q 'CVE-2017-7529'; then
        say "PATCHED: RPM package $pkg changelog references CVE-2017-7529 (backport/fix present)"
        exit 0
      fi
      # Known Red Hat SCL fixed build from RHSA-2017:2538
      nevra="$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' "$pkg" 2>/dev/null)"
      if [ "$pkg" = "rh-nginx110-nginx" ] && [ -n "$nevra" ]; then
        if [ "$nevra" = "1.10.2-8.el7" ] || ver_ge "$nevra" "1.10.2-8.el7"; then
          say "PATCHED: $pkg $nevra is at or above the RHSA-2017:2538 fixed build"
          exit 0
        fi
      fi
      break
    fi
  done
fi

# 3) Upstream version logic for source builds / nginx.org packages
# Affected: 0.5.6 through 1.13.2
# Fixed: 1.12.1+ on stable branch, 1.13.3+ on mainline branch
if ver_lt "$up_ver" "0.5.6"; then
  say "PATCHED: upstream version $up_ver predates the affected range"
  exit 0
fi

if ver_ge "$up_ver" "1.13.3"; then
  say "PATCHED: upstream version $up_ver is fixed"
  exit 0
fi

if ver_ge "$up_ver" "1.13.0" && ver_lt "$up_ver" "1.13.3"; then
  say "VULNERABLE: upstream version $up_ver is in the affected mainline range (1.13.0-1.13.2)"
  exit 1
fi

if ver_ge "$up_ver" "1.12.1" && ver_lt "$up_ver" "1.13.0"; then
  say "PATCHED: upstream stable version $up_ver is fixed"
  exit 0
fi

if ver_ge "$up_ver" "0.5.6" && ver_lt "$up_ver" "1.12.1"; then
  say "VULNERABLE: upstream version $up_ver is in the affected stable range (0.5.6-1.12.0)"
  exit 1
fi

say "UNKNOWN: unable to confidently map installed build to vendor-fixed package data"
exit 3