libcurl 7

#!/usr/bin/env python3
# check_libcurl_cve_2026_6276.py
# Detect likely exposure to CVE-2026-6276 (libcurl stale Host header cookie leak)
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import ctypes
import ctypes.util
import os
import platform
import re
import subprocess
import sys

LOW = (7, 71, 0)
HIGH = (8, 20, 0)


def parse_semver(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def vstr(v):
    return '.'.join(str(x) for x in v) if v else 'unknown'


def in_vuln_range(v):
    return v is not None and LOW <= v < HIGH


def is_patched_upstream(v):
    return v is not None and (v < LOW or v >= HIGH)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=5)
        return p.returncode, p.stdout.strip(), p.stderr.strip()
    except Exception:
        return 127, '', 'failed'


def get_libcurl_runtime_version():
    candidates = []
    found = ctypes.util.find_library('curl')
    if found:
        candidates.append(found)
    system = platform.system().lower()
    if system == 'windows':
        candidates += ['libcurl.dll', 'curl.dll']
    elif system == 'darwin':
        candidates += ['libcurl.4.dylib', 'libcurl.dylib']
    else:
        candidates += ['libcurl.so.4', 'libcurl.so']

    tried = []
    for name in candidates:
        if name in tried:
            continue
        tried.append(name)
        try:
            lib = ctypes.CDLL(name)
            lib.curl_version.restype = ctypes.c_char_p
            raw = lib.curl_version()
            if not raw:
                continue
            s = raw.decode(errors='ignore')
            m = re.search(r'libcurl/(\d+\.\d+\.\d+)', s)
            if m:
                return {'source': f'loaded library {name}', 'raw': s, 'version': parse_semver(m.group(1))}
            return {'source': f'loaded library {name}', 'raw': s, 'version': parse_semver(s)}
        except Exception:
            continue
    return None


def get_curl_cli_version():
    rc, out, _ = run_cmd(['curl', '--version'])
    if rc != 0 or not out:
        return None
    first = out.splitlines()[0]
    m = re.search(r'curl\s+(\d+\.\d+\.\d+)', first)
    if not m:
        return None
    return {'source': 'curl --version', 'raw': first, 'version': parse_semver(m.group(1))}


def get_package_evidence():
    evidence = []

    # dpkg families
    if shutil_which('dpkg-query'):
        for pkg in ['libcurl4', 'libcurl4t64', 'libcurl3-gnutls', 'libcurl3-nss', 'curl']:
            rc, out, _ = run_cmd(['dpkg-query', '-W', '-f=${Version}', pkg])
            if rc == 0 and out:
                evidence.append({'manager': 'dpkg', 'package': pkg, 'version_text': out})

    # rpm families
    if shutil_which('rpm'):
        for pkg in ['libcurl', 'curl']:
            rc, out, _ = run_cmd(['rpm', '-q', '--qf', '%{VERSION}-%{RELEASE}', pkg])
            if rc == 0 and out and 'not installed' not in out.lower():
                evidence.append({'manager': 'rpm', 'package': pkg, 'version_text': out})

    return evidence


def shutil_which(cmd):
    paths = os.environ.get('PATH', '').split(os.pathsep)
    exts = ['']
    if platform.system().lower() == 'windows':
        exts += os.environ.get('PATHEXT', '.EXE;.BAT;.CMD').split(';')
    for p in paths:
        for ext in exts:
            candidate = os.path.join(p, cmd + ext)
            if os.path.isfile(candidate) and os.access(candidate, os.X_OK):
                return candidate
    return None


def looks_like_distro_backport(version_text):
    vt = version_text.lower()
    markers = ['ubuntu', 'deb', '.el', 'amzn', 'suse', 'fc', 'ph', 'alpine', 'amazon']
    return any(m in vt for m in markers) or '-' in version_text


def main():
    runtime = get_libcurl_runtime_version()
    cli = get_curl_cli_version()
    packages = get_package_evidence()

    evidence = [x for x in [runtime, cli] if x]

    # Prefer runtime library evidence if present.
    chosen = runtime or cli

    if not chosen:
        print('UNKNOWN - could not determine a libcurl runtime or curl CLI version on this host')
        sys.exit(2)

    ver = chosen.get('version')
    if ver is None:
        print(f"UNKNOWN - unable to parse version from {chosen.get('source')}: {chosen.get('raw')}")
        sys.exit(2)

    if is_patched_upstream(ver):
        print(f"PATCHED - {chosen.get('source')} reports upstream version {vstr(ver)} outside the vulnerable range 7.71.0-8.19.0")
        sys.exit(0)

    # Version falls in the upstream vulnerable range. Check for distro packaging, where backports are common.
    for pkg in packages:
        if looks_like_distro_backport(pkg['version_text']):
            print(f"UNKNOWN - runtime reports {vstr(ver)} in the upstream vulnerable range, but distro package {pkg['package']}={pkg['version_text']} may include a backported fix; verify against your vendor advisory")
            sys.exit(2)

    print(f"VULNERABLE - {chosen.get('source')} reports upstream version {vstr(ver)} in the vulnerable range 7.71.0-8.19.0 and no distro backport evidence was found")
    sys.exit(1)


if __name__ == '__main__':
    main()