TencentOS Server 3: tomcat (TSSA-2026:1151)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:1151.
##

include('compat.inc');

if (description)
{
  script_id(365137);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2024-52316",
    "CVE-2024-54677",
    "CVE-2025-46701",
    "CVE-2025-55668",
    "CVE-2025-55754",
    "CVE-2025-61795",
    "CVE-2025-66614",
    "CVE-2026-24733",
    "CVE-2026-24880",
    "CVE-2026-25854",
    "CVE-2026-29145",
    "CVE-2026-34483",
    "CVE-2026-34487",
    "CVE-2026-41284",
    "CVE-2026-41293",
    "CVE-2026-42498",
    "CVE-2026-43512",
    "CVE-2026-43513",
    "CVE-2026-43514",
    "CVE-2026-43515",
    "CVE-2026-50229",
    "CVE-2026-53404",
    "CVE-2026-53434",
    "CVE-2026-55276",
    "CVE-2026-55955",
    "CVE-2026-55956",
    "CVE-2026-55957",
    "CVE-2026-59083",
    "CVE-2026-59084"
  );
  script_xref(name:"IAVA", value:"2024-A-0754-S");
  script_xref(name:"IAVA", value:"2024-A-0822-S");
  script_xref(name:"IAVA", value:"2025-A-0389-S");
  script_xref(name:"IAVA", value:"2025-A-0582-S");
  script_xref(name:"IAVA", value:"2025-A-0803-S");
  script_xref(name:"IAVA", value:"2026-A-0175-S");
  script_xref(name:"IAVA", value:"2026-A-0319-S");
  script_xref(name:"IAVA", value:"2026-A-0475");
  script_xref(name:"IAVA", value:"2026-A-0642-S");
  script_xref(name:"IAVA", value:"2026-A-0709-S");

  script_name(english:"TencentOS Server 3: tomcat (TSSA-2026:1151)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1151 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-52316:
    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta
    Authentication (formerly JASPIC)ServerAuthContext component which may throw an exception during the
    authentication process without explicitly setting an HTTP status to indicate failure, the authentication
    may not fail, allowing the user to bypass the authentication process. There are no known
    JakartaAuthentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from
    9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

    CVE-2024-54677:
    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache
    Tomcat leads to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from
    9.0.0.M1 through 9.9.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

    CVE-2025-46701:
    Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security
    constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI
    servlet.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from
    9.0.0.M1 through 9.0.104.

    Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

    CVE-2025-55668:
    Session Fixation vulnerability in Apache Tomcat via rewrite valve.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from
    9.0.0.M1 through 9.0.105.
    Older, EOL versions may also be affected.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-55754:
    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.

    Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a
    Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker
    to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard
    and attempt to trick an administrator into running an attacker controlled command. While no attack vector
    was found, it may have been possible to mount this attack on other operating systems.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from
    9.0.40 through 9.0.108.

    The following versions were EOL at the time the CVE was created but are
    known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.
    Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which
    fix the issue.

    CVE-2025-61795:
    Improper Resource Shutdown or Release vulnerability in Apache Tomcat.

    If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary
    copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage
    collection process to delete. Depending on JVM settings, application memory usage and application load, it
    was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared
    it, leading to a DoS.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from
    9.0.0.M1 through 9.0.109.

    The following versions were EOL at the time the CVE was created but are
    known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
    Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which
    fixes the issue.

    CVE-2025-66614:
    Improper Input Validation vulnerability.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from
    9.0.0-M1 through 9.0.112.

    The following versions were EOL at the time the CVE was created but are
    known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.
    Tomcat did not validate that the host name provided via the SNI
    extension was the same as the host name provided in the HTTP host header
    field. If Tomcat was configured with more than one virtual host and the
    TLS configuration for one of those hosts did not require client
    certificate authentication but another one did, it was possible for a
    client to bypass the client certificate authentication by sending
    different host names in the SNI extension and the HTTP host header field.



    The vulnerability only applies if client certificate authentication is
    only enforced at the Connector. It does not apply if client certificate
    authentication is enforced at the web application.


    Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which
    fix the issue.

    CVE-2026-24733:
    Improper Input Validation vulnerability in Apache Tomcat.


    Tomcat did not limit HTTP/0.9 requests to the GET method. If a security
    constraint was configured to allow HEAD requests to a URI but deny GET
    requests, the user could bypass that constraint on GET requests by
    sending a (specification invalid) HEAD request using HTTP/0.9.


    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from
    9.0.0.M1 through 9.0.112.


    Older, EOL versions are also affected.

    Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which
    fixes the issue.

    CVE-2026-24880:
    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache
    Tomcat via invalid chunk extension.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from
    9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Other, unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

    CVE-2026-25854:
    Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the
    LoadBalancerDrainingValve.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from
    9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
    Other, unsupported versions may also be affected

    Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

    CVE-2026-29145:
    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled
    vulnerability in Apache Tomcat, Apache Tomcat Native.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from
    9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from
    1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

    Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and
    9.0.116, which fix the issue.

    CVE-2026-34483:
    Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache
    Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from
    9.0.40 through 9.0.116.

    Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.

    CVE-2026-34487:
    Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering
    component of Apache Tomcat exposed the Kubernetes bearer token.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from
    9.0.13 through 9.0.116.

    Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

    CVE-2026-41284:
    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from
    9.0.0.M1 through 9.0.117.
    Older, unsupported versions may also be affected.

    Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

    CVE-2026-41293:
    Improper Input Validation vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from
    9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.
    Older, end of support versions may also be affected.

    Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

    CVE-2026-42498:
    Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability
    in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from
    9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.

    CVE-2026-43512:
    DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from
    9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.
    Older unsupported versions any also be affect

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-43513:
    Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from
    9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Older unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-43514:
    Observable Timing Discrepancy vulnerabilitywhen comparing AJP secret in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from
    9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Older unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-43515:
    Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same
    extension in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from
    9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-50229:
    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number
    guess example for Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from
    9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have
    reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

    CVE-2026-53404:
    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if
    the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from
    9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may
    also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

    CVE-2026-53434:
    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM
    based connector.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from
    9.0.83 through 9.0.118.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

    CVE-2026-55276:
    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and
    empty authorisation constraints were not included when the effective web.xml was logged.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from
    9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100.Other versions that have reached end of support may
    also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

    CVE-2026-55955:
    Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the
    EncryptionInterceptor in the cluster component.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from
    9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

    Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

    CVE-2026-55956:
    Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the
    default servlet ignoring any method or method omission configured as part of the constraint.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from
    9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have
    reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

    CVE-2026-55957:
    Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured
    to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct
    password.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from
    9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

    Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

    CVE-2026-59083:
    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed
    security constraint bypass for some configurations.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from
    9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100.Other versions that have reached end of support may
    also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

    CVE-2026-59084:
    Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely
    configure the EncryptInterceptor were not clearly documented.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from
    9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.Other versions that
    have reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20261151.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-66614");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-25854");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:tomcat");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'tomcat-9.0.120-1.tl3', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-admin-webapps-9.0.120-1.tl3', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-docs-webapp-9.0.120-1.tl3', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-el-3.0-api-9.0.120-1.tl3', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-jsp-2.3-api-9.0.120-1.tl3', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-lib-9.0.120-1.tl3', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-servlet-4.0-api-9.0.120-1.tl3', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'tomcat-webapps-9.0.120-1.tl3', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc');
}