Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2111)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-2111.
##

include('compat.inc');

if (description)
{
  script_id(342051);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/01");

  script_cve_id(
    "CVE-2026-64624",
    "CVE-2026-66402",
    "CVE-2026-67288",
    "CVE-2026-67289",
    "CVE-2026-67291",
    "CVE-2026-67293",
    "CVE-2026-67294",
    "CVE-2026-67295",
    "CVE-2026-67297",
    "CVE-2026-67298",
    "CVE-2026-67299",
    "CVE-2026-67300",
    "CVE-2026-67301",
    "CVE-2026-67302",
    "CVE-2026-67303",
    "CVE-2026-67304",
    "CVE-2026-67306",
    "CVE-2026-68580",
    "CVE-2026-73241",
    "CVE-2026-73242"
  );
  script_xref(name:"IAVA", value:"2026-A-0867");

  script_name(english:"Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2111)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2111 advisory.

    FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options,
    exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with
    /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or
    expose local filesystems without user interaction. (CVE-2026-64624)

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation
    weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because
    FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware
    identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g.
    'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when
    non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without
    comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to
    present such a certificate can bypass server identity verification, weakening TLS server authentication.
    (CVE-2026-66402)

    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request
    decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and
    SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted
    smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing
    client process termination. (CVE-2026-67288)

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the
    server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's
    ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy
    CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised
    RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary
    headers/requests into the HTTP proxy CONNECT request. (CVE-2026-67289)

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in
    update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a
    GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-controlled declared fragment size but does not
    verify it fits within the remaining received buffer before allocating and copying that many bytes. A
    malicious RDP server can send a short fragment with an oversized declared size, causing the client to read
    beyond the allocated buffer, resulting in an out-of-bounds read and client crash. (CVE-2026-67291)

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation
    vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a
    wildcard pattern such as *.example.com as matching any hostname ending in .example.com, so it incorrectly
    accepts a wildcard certificate for multi-label subdomains like a.b.example.com (which OpenSSL's
    X509_check_host() rejects). This weakens TLS server authentication under wildcard-certificate conditions.
    (CVE-2026-67293)

    FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate
    during client-side server TLS authentication. In x509_utils_verify(), when server-purpose
    (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose
    verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the
    RDP server certificate. In environments relying on EKU separation between client and server certificates,
    this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose
    validation. (CVE-2026-67294)

    FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection,
    allowing attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP
    server can read, write, delete, and enumerate files in sibling directories by sending non-rooted paths
    that bypass the shared-root boundary check. (CVE-2026-67295)

    FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked
    HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can
    send oversized chunked response bodies to exhaust client memory resources without triggering the
    configured size limit. (CVE-2026-67297)

    FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler
    (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header,
    the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first
    verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned
    integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check
    (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-
    of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash
    the server. Fixed in FreeRDP 3.29.0. (CVE-2026-67298)

    FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for
    WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In
    update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with
    the parser-owned windowIcon->iconInfo pointer. After the parser callback returns,
    update_recv_window_info_order() frees window_icon.iconInfo, but the queued async message still retains and
    later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window
    Alternate Secondary Order with WINDOW_ORDER_ICON can trigger use-after-free, leading to memory corruption
    and client crash. (CVE-2026-67299)

    FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message
    proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a
    malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies
    structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects,
    icon buffers). The parser frees those nested buffers after the callback returns, so the queued async
    message later dispatches stale pointers, potentially causing memory corruption or a client crash.
    (CVE-2026-67300)

    FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for
    the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-
    update), update_message_PolygonSC() and update_message_PolygonCB() allocate a fresh points array but copy
    point data from the address of the order structure instead of from polygonSC->points / polygonCB->points,
    resulting in a client-side out-of-bounds read. A malicious or compromised RDP server sending crafted
    PolygonSC/PolygonCB update orders can trigger memory disclosure or a client crash. (CVE-2026-67301)

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam
    camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled
    CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not
    FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with
    FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c)
    computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and
    termination of the FreeRDP client process. Camera redirection must be enabled on the client for the
    channel to be reachable. Fixed in FreeRDP 3.29.0. (CVE-2026-67302)

    FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned))
    in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device
    redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported
    IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0, causing
    the mismatch to trigger the assertion and abort the client process (denial of service). (CVE-2026-67303)

    FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control
    request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with
    non-zero cReaders and truncated reader-state data to crash the process via null pointer access in
    free_reader_states functions. (CVE-2026-67304)

    FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE
    bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in
    libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0-15 attacker-
    declared raw bytes are read without validating that the source buffer contains them. A malicious or
    compromised RDP server can send a truncated planar-encoded bitmap or surface update (reachable via both
    the Bitmap Update PDU and RDPGFX Surface Command paths) that causes the client to read past the end of the
    source buffer. The issue is fixed in FreeRDP 3.29.0. (CVE-2026-67306)

    FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel
    (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket
    parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size
    wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.
    (CVE-2026-68580)

    FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberos_DecryptMessage()
    (winpr/libwinpr/sspi/Kerberos/kerberos.c). The 16-bit EC (extra count) field of a peer-supplied GSS Wrap
    token (RFC 4121) is used directly in pointer arithmetic to locate the encrypted regions without being
    bounds-checked, while only RRC and the total buffer length are validated. A malicious peer (server or
    client) can supply a large EC value (up to 0xFFFF) during CredSSP/NLA authentication, moving the decrypt
    operation's base pointers past the end of the ~60-byte token buffer. Because the AES-CTS-HMAC enctypes
    decrypt in place before the HMAC integrity check, this results in an out-of-bounds read and in-place out-
    of-bounds write, potentially leading to information disclosure, memory corruption, or denial of service.
    (CVE-2026-72745)

    FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server
    is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the
    attacker-supplied wire pduType without verifying that the received PDU is the one required at the current
    step. Because the rdpRdstls object is calloc-zeroed, its resultCode defaults to 0 (RDSTLS_RESULT_SUCCESS).
    An unauthenticated remote client can send a Capabilities PDU instead of the required Authentication
    Request PDU; rdstls_process_capabilities() returns success without ever setting resultCode, so the server
    responds with an AUTHRSP carrying resultCode SUCCESS and treats the session as authenticated without
    evaluating any password, redirection GUID, or auto-reconnect cookie. This affects the released FreeRDP 3.x
    series (e.g., 3.27.1) and master HEAD; at the time of the advisory no patched version was available.
    (CVE-2026-72746)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side
    RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while
    rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ, leaving resultCode at RDSTLS_RESULT_SUCCESS
    and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password
    checks. This issue is fixed in version 3.30.0. (CVE-2026-73241)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's
    winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-
    controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious
    RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This
    issue is fixed in version 3.30.0. (CVE-2026-73242)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-2111.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-64624.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-66402.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67288.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67289.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67291.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67293.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67294.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67295.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67297.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67298.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67299.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67300.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67301.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67302.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67303.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67304.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-67306.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-68580.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-72745.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-72746.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-73241.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-73242.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update freerdp --releasever 2023.12.20260831' or
  or 'dnf update --advisory ALAS2023-2026-2111 --releasever 2023.12.20260831' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-67289");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-67294");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-libs-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-server-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'freerdp-3.6.3-1.amzn2023.0.15', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-3.6.3-1.amzn2023.0.15', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debuginfo-3.6.3-1.amzn2023.0.15', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debuginfo-3.6.3-1.amzn2023.0.15', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debugsource-3.6.3-1.amzn2023.0.15', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debugsource-3.6.3-1.amzn2023.0.15', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-devel-3.6.3-1.amzn2023.0.15', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-devel-3.6.3-1.amzn2023.0.15', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-3.6.3-1.amzn2023.0.15', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-3.6.3-1.amzn2023.0.15', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-debuginfo-3.6.3-1.amzn2023.0.15', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-debuginfo-3.6.3-1.amzn2023.0.15', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-server-3.6.3-1.amzn2023.0.15', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-server-3.6.3-1.amzn2023.0.15', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-server-debuginfo-3.6.3-1.amzn2023.0.15', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-server-debuginfo-3.6.3-1.amzn2023.0.15', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-3.6.3-1.amzn2023.0.15', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-3.6.3-1.amzn2023.0.15', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-debuginfo-3.6.3-1.amzn2023.0.15', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-debuginfo-3.6.3-1.amzn2023.0.15', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-devel-3.6.3-1.amzn2023.0.15', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-devel-3.6.3-1.amzn2023.0.15', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "freerdp / freerdp-debuginfo / freerdp-debugsource / etc");
}