diff --git a/2024-6387/check.yml b/2024-6387/check.yml index 1b3849b..25fb0a7 100644 --- a/2024-6387/check.yml +++ b/2024-6387/check.yml @@ -38,14 +38,33 @@ - debug: msg: "{{ openssh_version }}" - - name: Check if OpenSSH version is affected by CVE-2024-6387 + - name: "Parse OpenSSH server version" + set_fact: + openssh_version_number: "{% set ver_num = openssh_version.split('p')[0] | int %}" + + - debug: + msg: "{{ openssh_version_number }}" + + - name: "Parse OpenSSH server version" + set_fact: + openssh_version_suffix: "{% set ver_suffix = openssh_version.split('p')[1] | int %}" + when: openssh_version | regex_search('p\d+$') + + - name: "Some task that defines openssh_version_suffix (if needed)" + set_fact: + openssh_version_suffix: "p0" + when: openssh_version_suffix is undefined + + - debug: + msg: "{{ openssh_version_suffix }}" + + - name: "Check if OpenSSH version is affected by CVE-2024-6387" set_fact: is_vulnerable: > {% set ver_num = openssh_version.split('p')[0] | int %} - {% set ver_suffix = openssh_version.split('p')[1] | int %} {% if openssh_version in affected_versions or - (ver_num < min_safe_version.split('p')[0] | int) or - (ver_num == min_safe_version.split('p')[0] | int and ver_suffix < min_safe_version.split('p')[1] | int) %} + (ver_num < min_safe_version.split('p')[0] | int) or + (ver_num == min_safe_version.split('p')[0] | int and ver_suffix < min_safe_version.split('p')[1] | int) %} true {% else %} false @@ -55,3 +74,7 @@ debug: msg: > OpenSSH version {{ openssh_version }} is {% if is_vulnerable %} ## vulnerable ## {% else %} not vulnerable {% endif %} to CVE-2024-6387. + + - fail: + msg: "The server openssh version is vulnerable to CVE-2024-6387!!!" + when: is_vulnerable