PHP 7.4.x < 7.4.32 Multiple Vulnerabilities

#!/usr/bin/env bash
# check_php_165545.sh
# Verify exposure for Nessus plugin 165545 / PHP 7.4.x < 7.4.32
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_UPSTREAM="7.4.32"
FIXED_UBUNTU_FOCAL="7.4.3-4ubuntu2.15"
FIXED_DEBIAN_BULLSEYE="7.4.33-1+deb11u1"

print_result() {
  local status="$1"
  local msg="$2"
  echo "$status: $msg"
  case "$status" in
    PATCHED) exit 0 ;;
    VULNERABLE) exit 1 ;;
    *) exit 2 ;;
  esac
}

ver_ge() {
  # semantic-ish compare for upstream versions
  [ "$(printf '%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

php_ver=""
if command -v php >/dev/null 2>&1; then
  php_ver="$(php -r 'echo PHP_VERSION;' 2>/dev/null || true)"
fi

os_id=""
os_ver=""
if [ -r /etc/os-release ]; then
  . /etc/os-release
  os_id="${ID:-}"
  os_ver="${VERSION_ID:-}"
fi

# Debian/Ubuntu package-aware checks first because distro backports matter.
if command -v dpkg-query >/dev/null 2>&1; then
  pkg_ver=""
  for p in php7.4-cli php7.4-fpm libapache2-mod-php7.4 php7.4-common php7.4; do
    if dpkg-query -W -f='${Version}\n' "$p" >/dev/null 2>&1; then
      pkg_ver="$(dpkg-query -W -f='${Version}\n' "$p" 2>/dev/null | head -n1)"
      [ -n "$pkg_ver" ] && break
    fi
  done

  if [ -n "$pkg_ver" ]; then
    if [ "$os_id" = "ubuntu" ] && [ "$os_ver" = "20.04" ]; then
      if dpkg --compare-versions "$pkg_ver" ge "$FIXED_UBUNTU_FOCAL"; then
        print_result PATCHED "Ubuntu 20.04 package version $pkg_ver includes the fix line for CVE-2022-31628/CVE-2022-31629."
      else
        print_result VULNERABLE "Ubuntu 20.04 package version $pkg_ver is older than fixed backport $FIXED_UBUNTU_FOCAL."
      fi
    fi

    if [ "$os_id" = "debian" ] && [ "$os_ver" = "11" ]; then
      if dpkg --compare-versions "$pkg_ver" ge "$FIXED_DEBIAN_BULLSEYE"; then
        print_result PATCHED "Debian 11 package version $pkg_ver includes the DSA-5277 fix line."
      else
        print_result VULNERABLE "Debian 11 package version $pkg_ver is older than fixed backport $FIXED_DEBIAN_BULLSEYE."
      fi
    fi

    # Fallback for other dpkg-based systems: use the runtime version if available.
    if [ -n "$php_ver" ]; then
      case "$php_ver" in
        7.4.*)
          if ver_ge "$php_ver" "$FIXED_UPSTREAM"; then
            print_result PATCHED "Runtime reports PHP $php_ver (>= $FIXED_UPSTREAM)."
          else
            print_result VULNERABLE "Runtime reports PHP $php_ver (< $FIXED_UPSTREAM) and no recognized backport rule matched."
          fi
          ;;
        8.*|9.*)
          print_result PATCHED "Runtime reports PHP $php_ver; plugin 165545 targets 7.4.x only."
          ;;
      esac
    fi
  fi
fi

# RPM-based best-effort: changelog hit is stronger than raw version because of backports.
if command -v rpm >/dev/null 2>&1; then
  for p in php php-cli php-fpm php-common; do
    if rpm -q "$p" >/dev/null 2>&1; then
      if rpm -q --changelog "$p" 2>/dev/null | grep -Eq 'CVE-2022-31628|CVE-2022-31629|RHSA-2023:2903|ALSA-2023:2903|ELSA-2023:0848'; then
        print_result PATCHED "RPM package $p changelog shows a backport/fix reference for CVE-2022-31628/CVE-2022-31629."
      fi
    fi
  done
fi

# Pure upstream/source-build check.
if [ -n "$php_ver" ]; then
  case "$php_ver" in
    7.4.*)
      if ver_ge "$php_ver" "$FIXED_UPSTREAM"; then
        print_result PATCHED "Runtime reports upstream PHP $php_ver (>= $FIXED_UPSTREAM)."
      else
        print_result VULNERABLE "Runtime reports upstream PHP $php_ver (< $FIXED_UPSTREAM)."
      fi
      ;;
    8.*|9.*)
      print_result PATCHED "Runtime reports PHP $php_ver; this specific finding is for PHP 7.4.x."
      ;;
    *)
      print_result UNKNOWN "PHP runtime found ($php_ver), but this script only classifies PHP 7.4.x precisely for plugin 165545."
      ;;
  esac
fi

print_result UNKNOWN "Could not determine a PHP 7.4 runtime or package state with enough confidence. Check package manager metadata and distro advisories manually."