Amazon Linux 2023 : tomcat11, tomcat11-admin-webapps, tomcat11-el-6.0-api (ALAS2023-2026-3151)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-3151.
##

include('compat.inc');

if (description)
{
  script_id(365238);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-65182",
    "CVE-2026-65183",
    "CVE-2026-65637",
    "CVE-2026-65905",
    "CVE-2026-65927",
    "CVE-2026-66422",
    "CVE-2026-68525",
    "CVE-2026-68569",
    "CVE-2026-68763",
    "CVE-2026-73180",
    "CVE-2026-73581",
    "CVE-2026-75973",
    "CVE-2026-76183",
    "CVE-2026-77756",
    "CVE-2026-77762",
    "CVE-2026-77791",
    "CVE-2026-78383",
    "CVE-2026-78437",
    "CVE-2026-79677",
    "CVE-2026-86248",
    "CVE-2026-86350",
    "CVE-2026-87022"
  );
  script_xref(name:"IAVA", value:"2026-A-0902-S");
  script_xref(name:"IAVA", value:"2026-A-1039");

  script_name(english:"Amazon Linux 2023 : tomcat11, tomcat11-admin-webapps, tomcat11-el-6.0-api (ALAS2023-2026-3151)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3151 advisory.

    Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security
    constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for
    a shorter sub-path.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from
    9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.



    Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
    (CVE-2026-65182)

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain
    sockets allows an unauthorised local user to access the unix domain socket.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from
    9.0.42 through 9.0.120.



    Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
    (CVE-2026-65183)

    Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.



    This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115
    through 9.0.120.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-65637)

    Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before
    windowSize requests have been made, a client makes a DIGESTauthenticated request with a nonceCount on the
    upper boundary of thereplay window then that request is replayable once only while theassociated
    nonceCount remains within the replay window.





    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from
    9.0.0.M1 through 9.0.120.



    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.0
    through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-65905)

    Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes
    rewrite processing to restart at the second rule rather than the first rule.







    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from
    9.0.0.M1 through 9.0.120.



    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.0
    through 8.5.100. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.
    (CVE-2026-65927)

    Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being
    incorrectly used as role aliases within the Realm in additional to the correct usage with
    Request.isUserInRole().



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from
    9.0.25 through 9.0.120.



    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.46
    through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-66422)

    Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing
    of a security constraint that limits user has access to a resource POST but not GET.







    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from
    9.0.0.M1 through 9.0.120.







    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.0
    through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.















    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.
    (CVE-2026-68525)

    Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT,
    SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from
    9.0.0.M1 through 9.0.120.







    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.0
    through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.







    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-68569)

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2
    backlog tracking when a stream is reset



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from
    9.0.39 through 9.0.120.



    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.59
    through 8.5.100. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-68763)

    Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an
    authenticated HTTP session was changed after a WebSocket connection had been established under that
    authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket
    specification when the HTTP session ended.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from
    9.0.0.M1 through 9.0.120.



    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.0
    through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-73180)

    Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM
    TLS implementations ignore CRLs when certificate uses a keystore.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from
    9.0.0-M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0
    through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.
    (CVE-2026-73581)

    Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with
    SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the
    realm for the first web application to authenticate a request would be used for all web applications.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from
    9.0.0.M4 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0
    through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.
    (CVE-2026-75973)

    Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints
    for any WebSocket endpoint to be bypassed.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from
    9.0.0.M1 through 9.0.121.



    The following versions were EOS at the time the CVE was created but areknown to be affected: from 8.5.0
    through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-76183)

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache
    Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to
    cause one request from another user to fail when Tomcat is located behind a reverse proxy.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from
    9.0.47 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67
    through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77756)

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability
    in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from
    9.0.39 through 9.0.121.

    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.59
    through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
    (CVE-2026-77762)

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message
    enabled a DoS attack.

    This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74
    through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88
    through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77791)

    Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an
    unauthenticated AJP request to pin an AJP processing thread leading to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from
    9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0
    through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

    Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on
    timing) cause one request from another user to fail.

    This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116
    through 9.0.121.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78437)

    Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in
    Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from
    9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0
    through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-79677)

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled
    vulnerability in Apache Tomcat.



    This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from
    9.0.92 through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86248)

    Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache
    Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.



    This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118
    through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86350)

    Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket
    message smuggling when per-message-deflate is used.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from
    9.0.0.M1 through 9.0.121.

    The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0
    through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.
    (CVE-2026-87022)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3151.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-65182.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-65183.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-65637.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-65905.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-65927.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-66422.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-68525.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-68569.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-68763.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-73180.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-73581.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-75973.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-76183.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-77756.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-77762.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-77791.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-78383.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-78437.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-79677.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-86248.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-86350.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-87022.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update tomcat11 --releasever 2023.12.20261012' or
  or 'dnf update --advisory ALAS2023-2026-3151 --releasever 2023.12.20261012' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-86248");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat11");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat11-admin-webapps");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat11-docs-webapp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat11-el-6.0-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat11-jsp-4.0-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat11-lib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat11-servlet-6.1-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:tomcat11-webapps");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'tomcat11-11.0.26-1.amzn2023.0.1', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat11-admin-webapps-11.0.26-1.amzn2023.0.1', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat11-docs-webapp-11.0.26-1.amzn2023.0.1', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat11-el-6.0-api-11.0.26-1.amzn2023.0.1', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat11-jsp-4.0-api-11.0.26-1.amzn2023.0.1', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat11-lib-11.0.26-1.amzn2023.0.1', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat11-servlet-6.1-api-11.0.26-1.amzn2023.0.1', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'tomcat11-webapps-11.0.26-1.amzn2023.0.1', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "tomcat11 / tomcat11-admin-webapps / tomcat11-docs-webapp / etc");
}