cve-checker.sh

#!/bin/bash

# Author: Andrew Howard

# To-do:
# Take RHEL version as argument
# Read CVE list from file and/or stdin?
# Print relevant RHSA next to recommended minimum package versions
# Sort packages by version number, and print only newest

RHELVER=6
LIST="CVE-2015-0001 CVE-2015-0002
CVE-2015-0003
CVE-2015-0004 CVE-2015-0005 CVE-2015-0006
CVE-2015-0007"


# Requires rpmdevtools
PREREQS="rpmdev-vercmp"
BAIL=0
for COMMAND in $PREREQS; do
  which $COMMAND &>/dev/null
  if [ $? -ne 0 ]; then
    echo "Error: $COMMAND not found in PATH."
    BAIL=1
  fi
done
if [ $BAIL -ne 0 ]; then exit 0; fi


function newest() {
  read NEWEST;
  while read LINE; do
    rpmdev-vercmp $NEWEST $LINE &>/dev/null
    RETVAL=$?
    if [ $RETVAL -eq 12 ]; then
      NEWEST="$LINE"
    fi
  done
  echo "$NEWEST"
}


#
# Report this run to AppStats
( curl -s https://appstats.rackspace.com/appstats/event/ \
       -X POST \
       -H "Content-Type: application/json" \
       -d '{ "username": "andrew.howard",
             "status": "SUCCESS",
             "bizunit": "Enterprise",
             "OS": "Linux",
             "functionid": "N/A",
             "source": "https://github.com/StafDehat/scripts/blob/master/cve-checker.sh",
             "version": "1.0",
             "appid": "cve-checker.sh",
             "device": "N/A",
             "ip": "",
             "datey": "'$(date +%Y)'",
             "datem": "'$(date +%-m)'",
             "dated": "'$(date +%-d)'",
             "dateh": "'$(date +%-H)'",
             "datemin": "'$(date +%-M)'",
             "dates": "'$(date +%-S)'"
           }' & )  &>/dev/null


MINREQ=""
for CVE in $LIST; do
  ERRATA=$( curl https://access.redhat.com/security/cve/$CVE 2>/dev/null |
              sed -n '/<h2>Red Hat security errata<\/h2>/,/disclaimer/p' |
              sed -n '/.*<td>.* Linux.* '$RHELVER'.*<\/td>.*/,/<\/tr>/p' |
              sed -n 's/.*a href="https:\/\/rhn.redhat.com\/errata\/\(RHSA-[0-9]\+-[0-9]\+\).html".*/\1/p' |
              sort -u )
  if [ -z "$ERRATA" ]; then
    echo "$CVE: No errata for RHEL$RHELVER (https://access.redhat.com/security/cve/$CVE)"
  else
    for RHSA in $ERRATA; do
      echo "$CVE: $RHSA (https://rhn.redhat.com/errata/$RHSA.html)"
      CVE=$( echo "$CVE" | sed 's/./ /g' )
      MINREQ="$MINREQ
$( curl https://rhn.redhat.com/errata/$RHSA.html 2>/dev/null |
     sed -n 's/.*>\s*\(.*el'$RHELVER'[0-9\-\._]*\)\.x86_64\.rpm\s*<.*/\1/p' |
     sort -u ) "
    done
  fi
done

echo
echo "Affected packages:"
PKGS=$( echo "$MINREQ" | 
          sed -e 's/\([^.]*\).*/\1/' \
              -e 's/\(.*\)-.*/\1/' \
              -e 's/-[0-9][0-9]*$//' \
              -e '/^\s*$/d' |
          sort -u )
echo "$PKGS"

echo
echo "Minimum required versions:"
MINREQ=$( 
  for PKG in $PKGS; do
    VERSION=$( grep -P "$PKG-\d+[-\.].*$" <<<"$MINREQ" |
                 sed "s/$PKG-//" |
                 newest )
    echo "$PKG $VERSION"
  done | column -t
)
echo "$MINREQ"

# Exit here 'cause we don't know where the script is running
exit 0

echo
echo "Installed versions:"
for PKG in $PKGS; do
  VERSION=$( rpm -q --queryformat "%{VERSION}-%{RELEASE}.%{ARCH}\n" $PKG )
  if [ $? -eq 0 ]; then
    echo "$PKG $VERSION"
  fi
done | column -t

echo
echo "These affected packages are not installed:"
rpm -q $PKGS | grep 'not installed' | cut -d\  -f2
echo

echo
echo "You need to update the following:"
while read LINE; do
  PKG=$( echo "$LINE" | awk '{print $1}' )
  VERSION=$( echo "$LINE" | awk '{print $2}' )
  INSTALLED=$( rpm -q $PKG )
  if [ $? -eq 0 ]; then
    rpmdev-vercmp $INSTALLED $PKG-$VERSION &>/dev/null
    if [ $? -ne 11 ]; then
      echo $PKG
    fi
  fi
done <<<"$MINREQ"