{
  "document": {
    "aggregate_severity": {
      "text": "High"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.8esu/vex/2023/cve-2023-39322-els_os-tuxcare9_8esu.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-22T14:05:01Z",
      "generator": {
        "date": "2026-10-22T14:05:01Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2023-39322-ELS_OS-TUXCARE9.8ESU",
      "initial_release_date": "2023-09-08T17:15:00Z",
      "revision_history": [
        {
          "date": "2023-09-08T17:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-08T23:03:51Z",
          "number": "2",
          "summary": "Official Publication"
        },
        {
          "date": "2026-10-09T00:06:00Z",
          "number": "3",
          "summary": "Update document"
        },
        {
          "date": "2026-10-15T17:04:12Z",
          "number": "4",
          "summary": "Update document"
        },
        {
          "date": "2026-10-15T20:29:55Z",
          "number": "5",
          "summary": "Update document"
        },
        {
          "date": "2026-10-16T09:20:20Z",
          "number": "6",
          "summary": "Update document"
        },
        {
          "date": "2026-10-22T14:05:01Z",
          "number": "7",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "7"
    },
    "title": "Security update on CVE-2023-39322"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "AlmaLinux 9.8",
                "product": {
                  "name": "AlmaLinux 9.8",
                  "product_id": "AlmaLinux-9.8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:almalinux:almalinux:9.8:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "AlmaLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                "product": {
                  "name": "git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                  "product_id": "git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/git-lfs@3.7.1-4.el9_8.3?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                "product": {
                  "name": "git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                  "product_id": "git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/git-lfs@3.7.1-4.el9_8.3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "AlmaLinux OS Foundation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Rocky Linux 9.8",
                "product": {
                  "name": "Rocky Linux 9.8",
                  "product_id": "Rocky Linux-9.8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:resf:rocky_linux:9.8:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Rocky Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                "product": {
                  "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                  "product_id": "rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/rocky/git-lfs@3.7.1-4.el9_8.3?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                "product": {
                  "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                  "product_id": "rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/rocky/git-lfs@3.7.1-4.el9_8.3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Rocky Linux"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
                  "product_id": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/runc@1.4.2-3.el9_8.tuxcare.els1?arch=x86_64&epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                  "product_id": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/skopeo-tests@1.22.2-8.el9_8.tuxcare.els1?arch=x86_64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                  "product_id": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/skopeo@1.22.2-8.el9_8.tuxcare.els1?arch=x86_64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                  "product_id": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/buildah@1.43.3-2.el9_8.tuxcare.els1?arch=x86_64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                  "product_id": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/buildah-tests@1.43.3-2.el9_8.tuxcare.els1?arch=x86_64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
                "product": {
                  "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
                  "product_id": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/git-lfs@3.7.1-4.el9_8.3.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
                "product": {
                  "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
                  "product_id": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/runc@1.4.2-3.el9_8.tuxcare.els1?arch=aarch64&epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                "product": {
                  "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                  "product_id": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/skopeo-tests@1.22.2-8.el9_8.tuxcare.els1?arch=aarch64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                "product": {
                  "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                  "product_id": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/skopeo@1.22.2-8.el9_8.tuxcare.els1?arch=aarch64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                "product": {
                  "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                  "product_id": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/buildah@1.43.3-2.el9_8.tuxcare.els1?arch=aarch64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                "product": {
                  "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                  "product_id": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/buildah-tests@1.43.3-2.el9_8.tuxcare.els1?arch=aarch64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
                "product": {
                  "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
                  "product_id": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/git-lfs@3.7.1-4.el9_8.3.tuxcare.els1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.aarch64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.x86_64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64"
        },
        "product_reference": "rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64"
        },
        "product_reference": "rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-39322",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "description",
          "text": "QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64"
        ],
        "known_affected": [
          "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.aarch64",
          "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.x86_64",
          "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
          "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64"
        ],
        "known_not_affected": [
          "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
          "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
          "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
          "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
          "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2023-39322"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/523039",
          "url": "https://go.dev/cl/523039"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/62266",
          "url": "https://go.dev/issue/62266"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ",
          "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2023-2045",
          "url": "https://pkg.go.dev/vuln/GO-2023-2045"
        },
        {
          "category": "external",
          "summary": "https://security.gentoo.org/glsa/202311-09",
          "url": "https://security.gentoo.org/glsa/202311-09"
        },
        {
          "category": "external",
          "summary": "https://security.netapp.com/advisory/ntap-20231020-0004/",
          "url": "https://security.netapp.com/advisory/ntap-20231020-0004/"
        }
      ],
      "release_date": "2023-09-08T17:15:00Z",
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-10-15T02:54:41.739311Z",
          "details": "Affected",
          "product_ids": [
            "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.aarch64",
            "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.x86_64",
            "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
            "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.aarch64",
            "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.x86_64",
            "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
            "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        },
        {
          "category": "impact",
          "date": "2026-10-15T15:23:11.733213Z",
          "details": "CVE-2023-39322 affects QUIC connection handling in the Go standard library's crypto/tls package, which is not part of the runc package for TuxCare 9.8 ESU. The shipped runc 1.4.2 binary does not contain the crypto/tls code path where the flaw resides, so the vulnerable code is not present in this package.",
          "product_ids": [
            "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64"
          ]
        },
        {
          "category": "impact",
          "date": "2026-10-15T17:36:06.402651Z",
          "details": "The skopeo package for TuxCare 9.8 ESU is not affected by CVE-2023-39322. The flaw is in the QUIC connection handling in the Go standard library, and that code is not linked into the shipped skopeo binary because the Go linker drops unreachable code.",
          "product_ids": [
            "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
            "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
          ]
        },
        {
          "category": "impact",
          "date": "2026-10-15T15:24:16.015937Z",
          "details": "The buildah package for TuxCare 9.8 ESU is not affected by CVE-2023-39322. The shipped buildah binary is a statically linked Go program built with go1.26.7, and its function table contains no crypto/tls QUIC client or server entry points, so the vulnerable QUIC post-handshake message handling cannot be reached. A QUIC connection cannot be created by this binary, and the affected code therefore cannot run.",
          "product_ids": [
            "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
            "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64"
          ]
        }
      ]
    }
  ]
}