3 # implementing a version check of known bad OpenSSL versions, for example:
4 # https://support.google.com/faqs/answer/6376725?hl=en
6 # This is used in update.has_known_vulnerability()
11 # this list was generated using:
12 # for f in `curl | grep -Eo '[0-9]\.[0-9]\.[0-9][a-z]?' | sort -u`; do echo "'$f',"; done
16 r = requests.get('https://www.openssl.org/news/changelog.html')
21 for m in re.findall(b'[0-9]\.[0-9]\.[0-9][a-z]?', r.content):
22 version = str(m, encoding='utf-8')
23 if (version.startswith('1.0.1') and len(version) > 5 and version[5] >= 'r') \
24 or (version.startswith('1.0.2') and len(version) > 5 and version[5] >= 'f') \
25 or re.match(r'[1-9]\.[1-9]\.[0-9].*', version):
30 print('safe:', sorted(safe))
31 print('bad:', sorted(bad))