Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2026-1991)

🗓️ 04 Aug 2026 00:00:00Reported by TenableType 
nessus
 nessus🔗 www.tenable.com👁 13 Views

Heap buffer overflow in the database backend can be triggered by a crafted Packages.db, causing out-of-bounds writes.

Related
Refs
Code
ReporterTitlePublishedViews
Family
attackerkb
ATTACKERKB		CVE-2026-44605
5 Aug 202617:29
–attackerkb
amazon
Amazon		Important: rpm
4 Aug 202600:00
–amazon
circl
Circl		CVE-2026-44605
6 Aug 202612:00
–circl
cve
CVE		CVE-2026-44605
5 Aug 202617:29
–cve
cvelist
Cvelist		CVE-2026-44605 Rpm: heap buffer overflow in ndb slot table parsing
5 Aug 202617:29
–cvelist
debiancve
Debian CVE		CVE-2026-44605
5 Aug 202617:29
–debiancve
euvd
EUVD		EUVD-2026-53565
5 Aug 202617:29
–euvd
fedora
Fedora		[SECURITY] Fedora 44 Update: rpm-6.0.2-1.fc44
28 Jul 202601:01
–fedora
fedora
Fedora		[SECURITY] Fedora 43 Update: rpm-6.0.2-1.fc43
28 Jul 202601:18
–fedora
nessus
Tenable Nessus		Fedora 44 : rpm (2026-9985882270)
28 Jul 202600:00
–nessus
Rows per page
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-1991.
##

include('compat.inc');

if (description)
{
  script_id(332015);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/06");

  script_cve_id("CVE-2026-44605");

  script_name(english:"Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2026-1991)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1991 advisory.

    A heap buffer overflow exists in RPM's NDB database backend (lib/backend/ndb/rpmpkg.c) due to unchecked
    32-bit arithmetic when parsing the slot table. The slotnpages value is read directly from the on-disk NDB
    header and used in a 32-bit multiplication (slotnpages * (PAGE_SIZE / SLOT_SIZE)) to size a heap
    allocation. A crafted Packages.db can supply a slotnpages value that wraps this product to a small number,
    causing xcalloc to allocate an undersized buffer. The subsequent loop iterates over the full unwrapped
    page count, writing pkgslot entries past the heap boundary before per-slot validation runs. Exploitation
    requires the victim to open a crafted NDB database file with RPM tooling, and NDB is not the default
    backend in Fedora or RHEL (both default to sqlite). (CVE-2026-44605)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-1991.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-44605.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update rpm --releasever 2023.12.20260803' or
  or 'dnf update --advisory ALAS2023-2026-1991 --releasever 2023.12.20260803' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-44605");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-rpm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-rpm-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-apidocs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-build");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-build-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-build-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-build-libs-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-cron");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-devel-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-libs-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-audit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-audit-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-fapolicyd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-fapolicyd-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-ima");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-ima-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-prioreset");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-prioreset-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-selinux");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-selinux-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-syslog");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-syslog-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-systemd-inhibit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-plugin-systemd-inhibit-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-sign");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-sign-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-sign-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:rpm-sign-libs-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'python3-rpm-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3-rpm-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3-rpm-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3-rpm-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-apidocs-4.16.1.3-29.amzn2023.0.7', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-build-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-build-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-build-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-build-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-build-libs-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-build-libs-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-build-libs-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-build-libs-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-cron-4.16.1.3-29.amzn2023.0.7', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-debugsource-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-debugsource-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-devel-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-devel-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-devel-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-devel-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-libs-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-libs-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-libs-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-libs-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-audit-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-audit-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-audit-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-audit-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-fapolicyd-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-fapolicyd-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-fapolicyd-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-fapolicyd-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-ima-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-ima-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-ima-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-ima-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-prioreset-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-prioreset-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-prioreset-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-prioreset-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-selinux-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-selinux-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-selinux-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-selinux-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-syslog-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-syslog-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-syslog-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-syslog-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-systemd-inhibit-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-systemd-inhibit-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-systemd-inhibit-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-plugin-systemd-inhibit-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-sign-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-sign-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-sign-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-sign-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-sign-libs-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-sign-libs-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-sign-libs-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'rpm-sign-libs-debuginfo-4.16.1.3-29.amzn2023.0.7', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python3-rpm / python3-rpm-debuginfo / rpm / etc");
}

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
06 Aug 2026 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 3.15.5
EPSS0.00135
SSVC
package managerdatabase backendheap overflowcrafted databaselinux amazonsecurity advisoryvulnerability
13