Amazon Linux 2023 : openssl, openssl-devel, openssl-fips-provider-latest (ALAS2023-2026-2136)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-2136.
##

include('compat.inc');

if (description)
{
  script_id(345807);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/14");

  script_cve_id(
    "CVE-2026-14457",
    "CVE-2026-18798",
    "CVE-2026-54874",
    "CVE-2026-63072",
    "CVE-2026-63073",
    "CVE-2026-63074",
    "CVE-2026-63075",
    "CVE-2026-63076",
    "CVE-2026-75803"
  );
  script_xref(name:"IAVA", value:"2026-A-0878");

  script_name(english:"Amazon Linux 2023 : openssl, openssl-devel, openssl-fips-provider-latest (ALAS2023-2026-2136)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2136 advisory.

    Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)enabled, and only
    the private key (with no associated certificate) configured locally,a NULL pointer dereference may occur
    when the remote peer solicits raw public keys andalso sends the typically omitted
    signature_algorithms_cert TLS extension.

    Impact summary: The impact is limited to a possible Denial of Service as a result ofan application abort,
    no data disclosure or remote command execution are possible.

    CWE: CWE-476: NULL Pointer Dereference

    Description: While a passing comment in sample code in the documentation suggeststhat key-only RPK
    configurations are supported, the best-practice RPK configurationis to always configure a corresponding
    certificate (possibly self-signed orsigned by any convenient CA).

    When the private key is configured along with a matching certificate, thesignature_algorithms_cert
    extension is handled reliably even without thefix, and peer clients or servers that don't support raw
    public keys may beable to complete a TLS connection by pinning or verifying the correspondingcertificate
    or its public key.

    Deployments that prefer to configure just a private key with no certificateneed to upgrade to an updated
    release as noted below.

    FIPS impact: no

    No FIPS modules are affected by this issue, as the SSL protocol implementationis outside the OpenSSL FIPS
    module boundary. (CVE-2026-14457)

    Issue summary: QUIC server may double free QRX (QUIC record layer RX) objectwhen channel creation fails
    for initial packet.

    Impact summary: Double free leads to heap corruption, which typically results intermination of QUIC server
    process, leading to Denial of Service. There is sofar no evidence that this double free is exploitable for
    remote code execution,thus it is considered highly improbable.

    CWE: CWE-415: Double Free

    Description: In order to validate initial packet, OpenSSL QUIC stack defaultpacket handler
    (port_default_packet_handler()) creates a so-called QRX object.If the initial packet validates
    successfully with QRX object, the default packethandler proceeds to channel (connection object) creation.
    The QRX object usedfor packet validation is passed to port_bind_channel(), so it becomes part ofthe newly
    created connection. If port_bind_channel() fails, then it also freesthe QRX object. Once
    port_bind_channel() returns, the port_default_packet_handler()detects the failure and proceeds to the
    error branch, where the same QRX object isfreed for the second time.

    The failure in port_bind_channel() function can be induced with a relativelylow effort by a malformed (non
    RFC 9000 compliant) INITIAL packet. If the packetcarries DCID (destination connection ID) which is shorter
    than 8 bytes, thenport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()detects
    that the DCID has invalid length.

    FIPS impact: noThe FIPS module is not affected, as the QUIC implementation is outside ofthe OpenSSL FIPS
    module boundary. (CVE-2026-18798)

    Issue summary: Receiving a DTLS record for a future epoch while a handshakeis in progress causes OpenSSL
    to buffer far more memory than the recorditself requires.

    Impact summary: A peer can use a small amount of network traffic to make anOpenSSL DTLS endpoint retain a
    disproportionately large amount of memory,which may lead to a Denial of Service.

    CWE: CWE-405: Asymmetric Resource Consumption (Amplification)

    Description: While a DTLS handshake is in progress, a peer may legitimatelyhave already moved on to the
    next epoch (for example, having sent itsChangeCipherSpec and Finished messages) before the local endpoint
    hasprocessed the same transition, typically because of reordering on theunderlying UDP transport. OpenSSL
    buffers such early records so that theycan be processed once the local endpoint catches up.

    Buffering a record currently retains the entire read buffer it arrived in,which is sized to hold the
    largest possible DTLS record (around 16kilobytes), rather than just the bytes that make up the record
    itself. Upto 100 such records may be buffered per connection. As a result, a peerthat sends a stream of
    small forged records claiming to belong to the nextepoch can cause an OpenSSL DTLS endpoint to retain
    around 1.7 megabytes ofmemory, despite sending only a small fraction of that amount of data overthe
    network.

    An attacker therefore gains a memory amplification factor of around 1200,and can multiply the effect
    across as many associations as it is able toopen, making this a remote memory exhaustion Denial of Service
    risk forDTLS servers. Since the memory retained per connection remains bounded,and any limit an
    application already places on the number of concurrentassociations also bounds the total exposure, this
    issue has been assessedas Low severity.

    FIPS impact: no

    No FIPS modules are affected by this issue as the affected code is outsidethe OpenSSL FIPS module
    boundary.

    OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to thisissue.

    OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.OpenSSL 3.6 users should upgrade to OpenSSL
    3.6.4.OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.OpenSSL 3.4 users should upgrade to OpenSSL
    3.4.7.OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.

    Premium support customers only:OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1ziOpenSSL 1.0.2 users
    should upgrade to OpenSSL 1.0.2zr

    This issue was reported on 18 May 2026 by Amazon Web Services.The fix has been developed by Matt Caswell.

    -- cut (non-publishing metadata for internal use) --Reported by: Amazon Web ServicesFixed by: Matt Caswell
    (CVE-2026-54874)

    Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer basedon querying the unwrapped
    key size, but the AES-WRAP-PAD unwrap primitivecan write and cleanse more bytes than that query reports,
    causing an 8-byteout-of-bounds heap write.

    Impact summary: An attacker who supplies a crafted CMS message can trigger adeterministic 8-byte out-of-
    bounds heap write when the victim decrypts itwith CMS_decrypt(), corrupting the heap and typically
    resulting in a Denialof Service.

    CWE: CWE-787: Out-of-bounds Write

    Description: The key-wrap OID is potentially attacker-controlled on the wire.CMS unwrapping allows both
    id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.An attacker can take a legitimate message and change a
    single OID byte toselect the padded variant while leaving the message otherwise valid. Sincethe unwrap key
    is derived from the recipient's private operation (ECDH keyagreement or ML-KEM decapsulation), the RFC
    5649 integrity check cannotpass, and the decryption fails with integrity failure.

    The write is a fixed-size (8-byte), fixed-value (zero) heap overflowimmediately past the allocation,
    requires no special configuration, and isreachable from the public CMS_decrypt() function. The consequence
    isa heap corruption leading to a Denial of Service. The fix in the CMS codesizes the unwrap output buffer
    for the worst case so a failed unwrap cannotwrite past the allocation.

    FIPS impact: no

    As the CMS code lives outside the FIPS module boundary, no FIPSmodules are affected by this CVE.
    (CVE-2026-63072)

    Issue summary: OpenSSL CMP response validation passed an unexpected responsesender distinguished name
    directly as the format string to `ERR_raise_data()`.

    Impact summary: A malicious or intercepted CMP endpoint can crash a CMP clientthat enforces an expected
    sender or uses a pinned server certificate whosesubject becomes the default expected sender.

    CWE: CWE-134 (Use of Externally-Controlled Format String)

    Description: When validating a received CMP message, ossl_cmp_msg_check_update()converts the peer-supplied
    sender distinguished name with X509_NAME_oneline()and passes it directly as the format argument to
    ERR_raise_data(). Percentcharacters survive the conversion, so a sender DN such as CN=%s%n
    reachesBIO_vsnprintf() as an attacker-controlled format string with no matching variadicarguments. This
    path is only reached when the caller configures an expectedsender or pins a server certificate, which is
    the normal configuration for aCMP client validating server responses.

    Since the attacker controls the format string but none of the variadicarguments, such specifiers as %s and
    %n dereference or write through unrelatedstack contents and crash the client. The reliable consequence is
    a denial ofservice, when the response comes from a malicious or intercepted CMP endpoint.There is no
    controlled memory write, arbitrary-address read, or reliable pathto remote code execution.

    FIPS impact: no

    No FIPS modules are affected by this issue, as the CMP protocolimplementation is outside the OpenSSL FIPS
    module boundary. (CVE-2026-63073)

    Issue summary: The OpenSSL Certificate Management Protocol (CMP) cachesadditional certificates
    (extraCerts) sent in a CMP message, but never expungesthem (for instance if they are invalid).  If a
    server reuses an OSSL_CMP_CTXfrequently, this cache of extraCerts may grow unboundedly, and a
    maliciousclient may flood a CMP server with requests driving this growth.

    Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTXfor the lifetime of a server
    process may observe unbounded memory growth in theevent a malicious client repeatedly sends requests
    containing unique extracertificates, which may lead to OOM conditions.

    CWE: CWE-770: Allocation of Resources Without Limits or Throttling

    Description: If a remote user sends CMP messages to a server with a list ofextraCerts and the message is
    rejected, the extraCerts from the message remainsin the server contexts untrusted certificate stack.  This
    exposes servers withlong lived ctx objects to Denial of Service attacks in which an attacker sendsmessages
    intending to be rejected with a large list of additional certificatesrepeatedly, forcing the server to
    store them indefinitely.The issue was fixed by removing the added extra certs if the message isrejected,
    using the same method as when the context is configured to not docaching at all.

    FIPS impact: noAs the CMP code lives outside the FIPS module boundary, no FIPSmodules are affected by this
    CVE. (CVE-2026-63074)

    Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedlysends ack-eliciting packets
    while not acknowledging ACK-only responses, theQUIC stack can retain ACK-only packet metadata for the
    lifetime of theconnection.

    Impact summary: A remote peer that can complete a QUIC handshake cancause connection-scoped memory growth
    which may lead to Denial of Servicethrough memory exhaustion, especially with sustained traffic or many
    concurrentQUIC connections.

    CWE: CWE-770: Allocation of Resources Without Limits or Throttling

    Description: When the OpenSSL QUIC stack sends an ACK-only packet,there is no requirement by the QUIC
    protocol that the peer will acknowledgethat ACK-only packet (i.e. it is itself not ack-eliciting).
    However, the OpenSSLimplementation stores the metadata about the ACK frames regardless.In and of itself
    that's ok, but if a malicious peer establishes a connection, andthen drives the connection such that ACK-
    only packets are forced from theOpenSSL implementation peer (i.e., by sending numerous PING frames),and
    then withholding any subsequent acks for ack-eliciting data, likelegitimate data, said malicious peer can
    force inappropriate memory growthon the OpenSSL peer, potentially leading to a Denial of Service.

    The fix is to ensure that we account for the transmission of the ACK-onlypacket in the packet histories
    high and low watermark without actually storingthe ACK-only packet metadata itself.

    FIPS impact: noThe OpenSSL FIPS module is not affected as the QUIC code isoutside the FIPS module
    boundary. (CVE-2026-63075)

    Issue summary: OpenSSL CMP password based protection verification onlychecks whether the protectionAlg
    parameter was not NULL and not itsASN.1 type, before treating it as a PBMParameter. A crafted message
    cancontain a parameter of a different type, which is then dereferenced as aninvalid pointer.

    Impact summary: A remote, unauthenticated attacker can crash an applicationacting as a CMP server that
    accepts PBM-protected messages, or a CMP clienttalking to a malicious or intercepted CMP server, resulting
    in a Denial ofService.

    CWE: CWE-476: NULL Pointer Dereference

    Description: When verifying the password-based MAC protection of a CMPmessage, OpenSSL library reads the
    protectionAlg algorithm parameter withX509_ALGOR_get0(), which returns both the parameter type and its
    valuepointer. The value is then cast to an ASN1_STRING and treated as theexpected PBMParameter after only
    checking that pointer is not NULL. Theparameter type returned by X509_ALGOR_get0() was never consulted.

    This happens during protection verification, before any MAC is computed, sono knowledge of the PBM shared
    secret is required; the only precondition isthat PBM verification is reachable. On the server side this is
    reached fromOSSL_CMP_SRV_process_request() for any application that stands up a CMPserver accepting PBM-
    protected messages, and on the client side from CMPresponse validation against a malicious or on-path
    (MITM) server. Thereliable consequence is a denial of service; there is no memory disclosure,no controlled
    memory write, and no path to code execution. CMP is aspecialized feature that an application must
    explicitly enable.

    FIPS impact: noAs the CMP code lives outside the FIPS module boundary, no FIPS modulesare affected by this
    CVE. (CVE-2026-63076)

    Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADs (CVE-2026-75803)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-2136.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-14457.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-18798.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-54874.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63072.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63073.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63074.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63075.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63076.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-75803.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update openssl --releasever 2023.12.20260914' or
  or 'dnf update --advisory ALAS2023-2026-2136 --releasever 2023.12.20260914' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63073");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openssl-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openssl-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openssl-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openssl-fips-provider-latest");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openssl-fips-provider-latest-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openssl-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openssl-libs-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openssl-perl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openssl-snapsafe-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openssl-snapsafe-libs-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'openssl-3.5.8-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-3.5.8-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-debuginfo-3.5.8-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-debuginfo-3.5.8-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-debugsource-3.5.8-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-debugsource-3.5.8-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-devel-3.5.8-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-devel-3.5.8-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-fips-provider-latest-3.5.8-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-fips-provider-latest-3.5.8-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-fips-provider-latest-debuginfo-3.5.8-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-fips-provider-latest-debuginfo-3.5.8-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-libs-3.5.8-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-libs-3.5.8-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-libs-debuginfo-3.5.8-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-libs-debuginfo-3.5.8-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-perl-3.5.8-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-perl-3.5.8-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-snapsafe-libs-3.5.8-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-snapsafe-libs-3.5.8-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-snapsafe-libs-debuginfo-3.5.8-1.amzn2023.0.1', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'openssl-snapsafe-libs-debuginfo-3.5.8-1.amzn2023.0.1', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openssl / openssl-debuginfo / openssl-debugsource / etc");
}