EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3800)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346790);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/17");

  script_cve_id(
    "CVE-2023-5363",
    "CVE-2023-5678",
    "CVE-2024-4603",
    "CVE-2024-9143",
    "CVE-2024-13176",
    "CVE-2024-38797",
    "CVE-2024-38805",
    "CVE-2025-3770",
    "CVE-2025-9230",
    "CVE-2025-15467",
    "CVE-2025-68160",
    "CVE-2025-69418",
    "CVE-2025-69419",
    "CVE-2025-69420",
    "CVE-2025-69421",
    "CVE-2026-22795",
    "CVE-2026-31790"
  );

  script_name(english:"EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3800)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the EDK2 package installed, the EulerOS installation on the remote host is affected by the
following vulnerabilities :

    Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD
    parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a
    crash, causing Denial of Service, or potentially remote code execution. When parsing CMS
    (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector)
    encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length
    fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-
    based out-of-bounds write before any authentication or tag verification occurs. Applications and services
    that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-
    GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is
    required to trigger it. While exploitability to remote code execution depends on platform and toolchain
    mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4,
    3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module
    boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.OpenSSL 1.1.1 and 1.0.2 are not
    affected by this issue.(CVE-2025-15467)

    Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can
    trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which
    leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which
    can have various consequences including a Denial of Service or Execution of attacker-supplied code.
    Although the consequences of a successful exploit of this vulnerability could be severe, the probability
    that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in
    CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to
    our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue,
    as the CMS implementation is outside the OpenSSL FIPS module boundary.(CVE-2025-9230)

    Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths.
    This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers.
    Impact summary: A truncation in the IV can result in non-uniqueness,which could result in loss of
    confidentiality for some cipher modes. When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or
    EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have been
    established.  Any alterations to the key length, via the 'keylen' parameter or the IV length, via the
    'ivlen' parameter, within the OSSL_PARAM array will not take effect as intended, potentially causing
    truncation or overreading of these values.  The following ciphers and cipher modes are impacted: RC2, RC4,
    RC5, CCM, GCM and OCB. For the CCM, GCM and OCB cipher modes, truncation of the IV can result in loss of
    confidentiality.  For example, when following NIST's SP 800-38D section 8.2.1 guidance for constructing a
    deterministic IV for AES in GCM mode, truncation of the counter portion could lead to IV reuse. Both
    truncations and overruns of the key and overruns of the IV will produce incorrect results and could, in
    some cases, trigger a memory exception.  However, these issues are not currently assessed as security
    critical. Changing the key and/or IV lengths is not considered to be a common operation and the vulnerable
    API was recently introduced. Furthermore it is likely that application developers will have spotted this
    problem during testing since decryption would fail unless oth peers in the communication were similarly
    vulnerable. For these reasons we expect the probability of an application being vulnerable to this to be
    quite low. However if an application is vulnerable then this issue is considered very serious. For these
    reasons we have assessed this issue as Moderate severity overall. The OpenSSL SSL/TLS implementation is
    not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because the
    issue lies outside of the FIPS provider boundary. OpenSSL 3.1 and 3.0 are vulnerable to this
    issue.(CVE-2023-5363)

    Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or
    parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to
    generate an X9.42 DH key may experience long delays.  Likewise, applications that use DH_check_pub_key(),
    DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may
    experience long delays. Where the key or parameters that are being checked have been obtained from an
    untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks
    (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable
    for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an
    excessively large P, it doesn't check for an excessively large Q. An application that calls
    DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source
    could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also
    called by a number of other OpenSSL functions.  An application calling any of those other functions may
    similarly be affected.  The other functions affected by this are DH_check_pub_key_ex(),
    EVP_PKEY_public_check(), and EVP_PKEY_generate().Also vulnerable are the OpenSSL pkey command line
    application when using the '-pubcheck' option, as well as the OpenSSL genpkey command line application.
    The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers
    are not affected by this issue.(CVE-2023-5678)

    EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a
    corrupted data pointer and length are sent via an adjecent network. A successful exploit of this
    vulnerability may lead to a loss of Integrity and/or Availability.(CVE-2024-38797)

    EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network
    means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)

    Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary:
    Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA
    public key or DSA parameters may experience long elays. Where the key or parameters that are being checked
    have been obtained from an untrusted source this may lead to a Denial of Service. The functions
    EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those
    computations take a long time if the modulus (`p` parameter) is too large.Trying to use a very large
    modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in
    length for signature verification. However the key and parameter check functions do not limit the modulus
    size when performing the checks. An application that calls EVP_PKEY_param_check() or
    EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be
    vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted
    DSA keys so only applications that directly call these functions may be vulnerable.Also vulnerable are the
    OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL SSL/TLS
    implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this
    issue.(CVE-2024-4603)

    Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the
    field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory
    writes can lead to an application crash or even a possibility of a remote code execution, however, in all
    the protocols involving Elliptic Curve Cryptography that we're aware of, either only 'named curves' are
    supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary
    (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a
    vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509
    certificates, so problematic inputs cannot occur in the context of processing X.509 certificates.  Any
    problematic use-cases would have to be using an 'exotic' curve encoding. The affected APIs include:
    EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions.
    Applications working with 'exotic' explicit binary (GF(2^m)) curve parameters, that make it possible to
    represent invalid field polynomials with a zero constant term, via the above or similar APIs, may
    terminate abruptly as a result of reading or writing outside of array bounds.  Remote code execution
    cannot easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this
    issue.(CVE-2024-9143)

    EDK2 contains a vulnerability in BIOS where an attacker may cause 'Protection Mechanism Failure' by local
    access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact
    Confidentiality, Integrity, and Availability.(CVE-2025-3770)

    Issue summary: A timing side-channel which could potentially allow recovering the private key exists in
    the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations
    could allow recovering the private key by an attacker. However, measuring the timing would require either
    local access to the signing application or a very fast network connection with low latency. There is a
    timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This
    can happen with significant probability only for some of the supported elliptic curves. In particular the
    NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located
    in the same physical computer or must
    have a very fast network connection with low latency. For that reason the severity of this vulnerability
    is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.(CVE-2024-13176)

    Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the
    next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-
    bounds write can cause memory corruption which
    typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO
    filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line
    applications, it is typically only pushed onto stdout/stderr on VMSystems. Third-party applications that
    explicitly use this filter with a BIO chain that can short-write and that write large, newline-free data
    influenced by an attacker would be affected. However, the circumstances where this could happen are
    unlikely to be under attacker control, and BIO_f_linebuffer is unlikely to be handling non-curated data
    controlled by an attacker. For that reason the issue was assessed as Low severity. The FIPS modules in
    3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the BIO implementation is outside the
    OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this
    issue.(CVE-2025-68160)

    Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the
    PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash
    which leads to Denial of Service for an application processing PKCS#12 files. The
    PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before
    dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter
    can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to
    achieve code execution or memory disclosure. Exploiting this issue requires an attacker to provide a
    malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low
    severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected
    by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.OpenSSL 3.6, 3.5,
    3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.(CVE-2025-69421)

    Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed
    PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to
    dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion
    vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first
    validating the type, causing an invalid pointer read.The location is constrained to a 1-byte address
    space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This
    range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably
    result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or
    application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12
    files in applications as they are usually used to store private keys which are trusted by definition. For
    these reasons, the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not
    affected by this issue, as the PKCS12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL
    3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this
    issue.(CVE-2026-22795)

    Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a
    BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before
    the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have
    various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass
    conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the
    helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the
    destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes,
    but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is
    added to the output length without validation, causing the length to become negative. The subsequent
    trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer.
    The vulnerability is reachable via the public PKCS12 get_friendlyname() API when parsing attacker-
    controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue,
    PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to
    provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one
    zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity
    according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this
    issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4,
    3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this
    issue.(CVE-2025-69419)

    Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send
    contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer
    might contain sensitive data from the revious execution of the application process which leads to
    sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success
    and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA
    encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave
    the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If
    applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key
    without first validating that key, then this may cause stale or uninitialized contents of the caller-
    provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround
    calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will
    mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this
    issue.(CVE-2026-31790)

    Issue summary: When using the low-level OCB API directly with AES-NI orbrother hardware-accelerated
    code paths, inputs whose length is not a multiplebrof 16 bytes can leave the final partial block
    unencrypted and unauthenticated.brbrImpact summary: The trailing 1-15 bytes of a message may
    be exposed inbrcleartext on encryption and are not covered by the authentication
    tag,brallowing an attacker to read or tamper with those bytes without detection.brbrThe
    low-level OCB encrypt and decrypt routines in the hardware-acceleratedbrstream path process full
    16-byte blocks but do not advance the input/outputbrpointers. The subsequent tail-handling code then
    operates on the originalbrbase pointers, effectively reprocessing the beginning of the buffer
    whilebrleaving the actual trailing bytes unprocessed. The authentication checksumbralso
    excludes the true tail bytes.brbrHowever, typical OpenSSL consumers using EVP are not affected
    because thebrhigher-level EVP and provider OCB implementations split inputs so that
    fullbrblocks and trailing partial blocks are processed in separate calls, avoidingbrthe
    problematic code path. Additionally, TLS does not use OCB ciphersuites.brThe vulnerability only
    affects applications that call the low-levelbrCRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt()
    functions directly withbrnon-block-aligned lengths in a single call on hardware-accelerated
    builds.brFor these reasons the issue was assessed as Low severity.brbrThe FIPS modules
    in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affectedbrby this issue, as OCB mode is not a FIPS-
    approved algorithm.brbrOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this
    issue.brbrOpenSSL 1.0.2 is not affected by this issue.(CVE-2025-69418)

    Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an
    ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer
    dereference when processing a malformed TimeStamp Response file. Impact summary: An application calling
    TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or
    NULL pointer when reading, resulting in a Denial of Service. The functions ossl_ess_get_signing_cert() and
    ossl_ess_get_signing_cert_v2() access the signing cert attribute value without validating its type. When
    the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory through the ASN1_TYPE union,
    causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed TimeStamp
    Response to an application that verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not
    widely used and the impact of the exploit is just a Denial of Service. For these reasons the issue was
    assessed as Low severity.The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the
    TimeStamp Response implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3,
    3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.(CVE-2025-69420)

Tenable has extracted the preceding description block directly from the EulerOS EDK2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3800
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8f404106");
  script_set_attribute(attribute:"solution", value:
"Update the affected EDK2 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-9143");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/06/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:edk2-ovmf");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(15)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);

var flag = 0;

var pkgs = [
  "edk2-ovmf-202308-17.h21510.29.eulerosv2r15"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"15", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "EDK2");
}