OSquery for detecting RegreSSHion CVE-2024-6387

regreSSHion.sql

SELECT 'DEB Package' AS PACKAGE_MANAGER, name, version, CAST(SUBSTR(version, 3, 3) AS FLOAT) AS float_version,
    CASE
        WHEN CAST(SUBSTR(version, 3, 3) AS FLOAT) < 4.4 THEN 'YES (Unless patched for CVE-2006-5051 and CVE-2008-4109)'
        WHEN CAST(SUBSTR(version, 3, 3) AS FLOAT) >= 4.4 AND CAST(SUBSTR(version, 3, 3) AS FLOAT) < 8.5 THEN 'NOT Vulnerable'
        WHEN CAST(SUBSTR(version, 3, 3) AS FLOAT) >= 8.5 AND CAST(SUBSTR(version, 3, 3) AS FLOAT) <= 9.7 THEN 'Potentially Vulnerable'
        ELSE 'UNKNOWN'
    END AS vulnerability_status
FROM 
    deb_packages
WHERE 
    source LIKE 'openssh' or name like 'openssh%'
UNION
SELECT 'RPM Package' AS PACKAGE_MANAGER, name, version, CAST(SUBSTR(version, 3, 3) AS FLOAT) AS float_version,
    CASE
        WHEN CAST(SUBSTR(version, 3, 3) AS FLOAT) < 4.4 THEN 'YES (Unless patched for CVE-2006-5051 and CVE-2008-4109)'
        WHEN CAST(SUBSTR(version, 3, 3) AS FLOAT) >= 4.4 AND CAST(SUBSTR(version, 3, 3) AS FLOAT) < 8.5 THEN 'NOT Vulnerable'
        WHEN CAST(SUBSTR(version, 3, 3) AS FLOAT) >= 8.5 AND CAST(SUBSTR(version, 3, 3) AS FLOAT) <= 9.7 THEN 'Potentially Vulnerable'
        ELSE 'UNKNOWN'
    END AS vulnerability_status
FROM 
    rpm_packages
WHERE 
    source LIKE 'openssh' or name like 'openssh%';