OpenSSL 1.1.1 < 1.1.1zg Multiple Vulnerabilities

#!/bin/bash
# OpenSSL 1.1.1zg vulnerability check
# Checks for CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390
# Run on target host. No root required.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

OPENSSL_BIN=$(command -v openssl 2>/dev/null)
if [ -z "$OPENSSL_BIN" ]; then
  echo "UNKNOWN - openssl binary not found in PATH"
  exit 2
fi

VERSION_STRING=$($OPENSSL_BIN version 2>/dev/null)
if [ $? -ne 0 ]; then
  echo "UNKNOWN - failed to execute openssl version"
  exit 2
fi

echo "Detected: $VERSION_STRING"

# Check if this is OpenSSL 1.1.1
if echo "$VERSION_STRING" | grep -qE 'OpenSSL 1\.1\.1'; then
  # Extract the letter suffix (e.g., 'zf', 'zg', 'w')
  SUFFIX=$(echo "$VERSION_STRING" | sed -n 's/.*OpenSSL 1\.1\.1\([a-z]*\).*/\1/p')
  
  # 1.1.1zg and later are patched
  # Compare lexicographically: zg, zh, zi... are patched
  if [ -z "$SUFFIX" ]; then
    # Base 1.1.1 with no suffix - vulnerable
    echo "VULNERABLE - OpenSSL 1.1.1 (no patch suffix) is affected"
    exit 1
  fi
  
  # zg = patched. Anything before zg = vulnerable.
  # Letters: a-z = 1.1.1a through 1.1.1z, then za-zf = vulnerable, zg+ = patched
  if echo "$SUFFIX" | grep -qE '^z[g-z]'; then
    echo "PATCHED - OpenSSL 1.1.1$SUFFIX is >= 1.1.1zg"
    exit 0
  else
    echo "VULNERABLE - OpenSSL 1.1.1$SUFFIX is below 1.1.1zg"
    exit 1
  fi

# Check if this is OpenSSL 3.0.x
elif echo "$VERSION_STRING" | grep -qE 'OpenSSL 3\.0\.'; then
  MINOR=$(echo "$VERSION_STRING" | sed -n 's/.*OpenSSL 3\.0\.\([0-9]*\).*/\1/p')
  if [ "$MINOR" -ge 20 ] 2>/dev/null; then
    echo "PATCHED - OpenSSL 3.0.$MINOR >= 3.0.20"
    exit 0
  else
    echo "VULNERABLE - OpenSSL 3.0.$MINOR < 3.0.20"
    exit 1
  fi

# Check 3.3.x, 3.4.x, 3.5.x, 3.6.x
elif echo "$VERSION_STRING" | grep -qE 'OpenSSL 3\.[3456]\.'; then
  BRANCH=$(echo "$VERSION_STRING" | sed -n 's/.*OpenSSL 3\.\([0-9]*\)\.\([0-9]*\).*/\1/p')
  PATCH=$(echo "$VERSION_STRING" | sed -n 's/.*OpenSSL 3\.\([0-9]*\)\.\([0-9]*\).*/\2/p')
  case "$BRANCH" in
    3) FIXED=7 ;;
    4) FIXED=5 ;;
    5) FIXED=6 ;;
    6) FIXED=2 ;;
    *) echo "UNKNOWN - unrecognized branch 3.$BRANCH"; exit 2 ;;
  esac
  if [ "$PATCH" -ge "$FIXED" ] 2>/dev/null; then
    echo "PATCHED - OpenSSL 3.$BRANCH.$PATCH >= 3.$BRANCH.$FIXED"
    exit 0
  else
    echo "VULNERABLE - OpenSSL 3.$BRANCH.$PATCH < 3.$BRANCH.$FIXED"
    exit 1
  fi

else
  echo "UNKNOWN - not an affected OpenSSL branch ($VERSION_STRING)"
  exit 2
fi