Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-2033)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-2033.
##

include('compat.inc');

if (description)
{
  script_id(331989);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/06");

  script_cve_id(
    "CVE-2026-42955",
    "CVE-2026-44621",
    "CVE-2026-44687",
    "CVE-2026-44690",
    "CVE-2026-46582",
    "CVE-2026-50046",
    "CVE-2026-50243",
    "CVE-2026-50248",
    "CVE-2026-50251",
    "CVE-2026-50252",
    "CVE-2026-55708",
    "CVE-2026-55717",
    "CVE-2026-56416"
  );

  script_name(english:"Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-2033)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2033 advisory.

    In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in
    the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window
    by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names'
    attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single
    client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and
    essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In
    configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is
    required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only
    addressed the NS query. (CVE-2026-42955)

    With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured
    with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and
    libunbound needs to call 'libworker_alloc_cleanup' since the function is absent from the function call
    allow list. When an application using libunbound sets 'unwanted-reply-threshold' to any non-zero value and
    the iterator queries an authoritative that replies with enough wrong-transaction-ID UDP datagrams to cross
    the threshold, the 'libworker_alloc_cleanup' will eventually be called. Since the function is absent from
    the function call allow list, this leads to a fatal exit of libunbound and eventual termination of the
    embedding application.Unbound itself is not affected since its relevant function 'worker_alloc_cleanup' is
    registed in the allow list and proceeds to perform the documented cache flush. (CVE-2026-44621)

    In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an
    intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure
    NXDOMAIN answer from the parent. This is caused by an off-by-one error in 'harden-below-nxdomain' logic;
    enabled by default. It effectively bypasses the configuration and the configured stub/forward zone is
    never contacted. 'harden-below-nxdomain' does an upward DNS cache walk together with a delegation point
    guard that does not allow NXDOMAIN synthesis above stub/forward zones. The guard tests the domain name but
    before stripping a label. This results in an iteration where the domain name equals the configured
    stub/forward zone apex that passes the guard, strips one more label, and probes the cache at the apex's
    immediate public parent. If that parent has a cached DNSSEC-secure NXDOMAIN, which it will for any private
    namespace nested two or more labels under a signed public name, the walk returns it and the configured
    stub/forward upstream is never contacted. This can only be triggered by the query for the intermediate
    label (between the stub/forward apex and the DNSSEC parent zone). (CVE-2026-44687)

    In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field
    combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning
    that permits a malicious actor controlling a single delegated zone to poison arbitrary sibling zones under
    NSEC-signed parent domains. A malicious actor with one registered domain under an NSEC-signed TLD can
    serve malicious insecure DNS responses for unrelated sibling domains (sharing the same parent zone).
    Arbitrary delegations that do not exist under the parent domain and are covered by the parent's NSEC chain
    can be brought into insecure existence by fraudulent wildcard DS records (less labels than expected,
    unknown algorithm) from the malicious sibling domain. This allows the malicious actor to inject insecure
    wildcard records for those delegations. (CVE-2026-44690)

    In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of
    data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache,
    before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure
    on the rrset, and another thread that is on the serve expired path then picks up the updated rrset
    contents with the secure status for a reply, it can be used to change a specific record, next to a
    wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the
    possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME
    wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then
    quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry)
    query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is
    injected into the response, the wildcard rrset will update the expired sibling record with a secure status
    before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper
    answer as bogus. The updated poisoned rrset is now secure and points to the wildcard. This vulnerability
    is explicit for the serve expired path and needs injection of the signed wildcard rrset without the NSEC
    accompanying rrset. (CVE-2026-46582)

    In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT)
    forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct
    ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still
    handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it
    dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash
    resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration
    could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder
    pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of
    jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a
    vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured
    '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a
    transient failure at the correct time in order to kick off the vulnerable error path. (CVE-2026-50046)

    In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip'
    module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP
    trigger, the rewriting handler does not check the security status of the upstream answer and can instead
    rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. If the validator finds an expired
    or otherwise invalid RRSIG on an answer whose A record falls within a 'response-ip'/RPZ configuration, the
    answer is still rewritten and given a hard coded security level of INSECURE. This results in the client
    receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. A malicious actor can
    exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator's
    configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator's
    configured target. (CVE-2026-50243)

    In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary
    hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious
    actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary
    and can replaces the entire zone/the resolver's entire response policy. (CVE-2026-50248)

    In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set
    to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that
    can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies since the remote
    IP does not match the original source IP of 0.0.0.0/::0. This behavior keeps on looping for the glue
    records and pushing the counter to the configured 'unwanted-reply-threshold' that triggers a defensive
    cache clear. A malicious actor who controls a delegation that returns in-bailiwick glue of 0.0.0.0/::0 can
    drive the counter to the limit of 'unwanted-reply-threshold' to the threshold and trigger a cache clean of
    the message and rrset caches; at will, indefinitely, without sending a single spoofed packet. The iterator
    uses the 0.0.0.0/::0 glue, and a system that can route this (e.g., Linux kernel routes the datagram over
    loopback), Unbound's own listener answers from 127.0.0.1. Because of the mismatch of 0.0.0.0 and
    127.0.0.1, in this example, Unbound accounts the reply as an unwanted (probably spoofed) answer. The
    counter resets to zero on every cache flush, so the attack loops forever. (CVE-2026-50251)

    In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to
    serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing
    policies depend on the source port while their outcome is revealed this secrecy is undermined. The
    vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP
    port and IP address while heavily depending on the incoming source UDP port as a randomization source.
    When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it
    meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound
    randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size,
    assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel's
    SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a
    particular thread. All outgoing DNS queries generated during the resolution of that request use source
    ports selected exclusively from the port subset assigned to the corresponding thread. Since these port
    subsets are disjoint across threads, the source port observed in a resolver's outgoing query to an
    authoritative name server serves as a reliable indicator of the worker thread that processed the original
    client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given
    fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks
    by effectively lowering the random port population per thread. (CVE-2026-50252)

    In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas'
    commands of 'unbound-control' create a bare local zones tree for an already configured named view when the
    view is configured with no local data to begin with. However, the creation through the control interface
    omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once
    the local zone tree exists without the defaults, every query for a default-protected name from a client
    mapped to that view escapes to the public DNS via the iterator instead of being answered locally,
    bypassing local policy expectations. (CVE-2026-55708)

    In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a
    'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-
    override' equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-
    expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the
    second pass it resets 'alias_rrset' but not 'partial_rep'. Later, this inconsistency leads to a NULL
    pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling
    any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By
    delaying the answer when the previous record has expired, the vulnerable path of 'serve-expired-client-
    timeout' is taken leading to denial of service via the server crash. (CVE-2026-55717)

    In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA
    form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain
    name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without
    checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname
    RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server
    can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()'
    to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that
    heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow
    and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap
    chunk. (CVE-2026-56416)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-2033.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-42955.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-44621.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-44687.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-44690.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-46582.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50046.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50243.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50248.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50251.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-50252.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-55708.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-55717.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56416.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update unbound --releasever 2023.12.20260803' or
  or 'dnf update --advisory ALAS2023-2026-2033 --releasever 2023.12.20260803' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/U:Amber");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-50252");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-unbound");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-unbound-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-anchor");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-anchor-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-libs-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-utils");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:unbound-utils-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'python3-unbound-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3-unbound-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3-unbound-debuginfo-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3-unbound-debuginfo-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-anchor-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-anchor-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-anchor-debuginfo-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-anchor-debuginfo-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-debuginfo-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-debuginfo-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-debugsource-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-debugsource-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-devel-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-devel-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-libs-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-libs-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-libs-debuginfo-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-libs-debuginfo-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-utils-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-utils-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-utils-debuginfo-1.17.1-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'unbound-utils-debuginfo-1.17.1-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python3-unbound / python3-unbound-debuginfo / unbound / etc");
}