{
  "document": {
    "aggregate_severity": {
      "text": "High"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.8esu/vex/2023/cve-2023-39321-els_os-tuxcare9_8esu.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-22T14:04:57Z",
      "generator": {
        "date": "2026-10-22T14:04:57Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2023-39321-ELS_OS-TUXCARE9.8ESU",
      "initial_release_date": "2023-09-08T17:15:00Z",
      "revision_history": [
        {
          "date": "2023-09-08T17:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-08T23:03:48Z",
          "number": "2",
          "summary": "Official Publication"
        },
        {
          "date": "2026-10-09T00:05:57Z",
          "number": "3",
          "summary": "Update document"
        },
        {
          "date": "2026-10-15T20:29:20Z",
          "number": "4",
          "summary": "Update document"
        },
        {
          "date": "2026-10-16T09:20:18Z",
          "number": "5",
          "summary": "Update document"
        },
        {
          "date": "2026-10-22T14:04:57Z",
          "number": "6",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "6"
    },
    "title": "Security update on CVE-2023-39321"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "AlmaLinux 9.8",
                "product": {
                  "name": "AlmaLinux 9.8",
                  "product_id": "AlmaLinux-9.8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:almalinux:almalinux:9.8:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "AlmaLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                "product": {
                  "name": "git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                  "product_id": "git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/git-lfs@3.7.1-4.el9_8.3?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                "product": {
                  "name": "git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                  "product_id": "git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/git-lfs@3.7.1-4.el9_8.3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "AlmaLinux OS Foundation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Rocky Linux 9.8",
                "product": {
                  "name": "Rocky Linux 9.8",
                  "product_id": "Rocky Linux-9.8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:resf:rocky_linux:9.8:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Rocky Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                "product": {
                  "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                  "product_id": "rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/rocky/git-lfs@3.7.1-4.el9_8.3?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                "product": {
                  "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                  "product_id": "rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/rocky/git-lfs@3.7.1-4.el9_8.3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Rocky Linux"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
                  "product_id": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/runc@1.4.2-3.el9_8.tuxcare.els1?arch=x86_64&epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                  "product_id": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/skopeo-tests@1.22.2-8.el9_8.tuxcare.els1?arch=x86_64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                  "product_id": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/skopeo@1.22.2-8.el9_8.tuxcare.els1?arch=x86_64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                  "product_id": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/buildah@1.43.3-2.el9_8.tuxcare.els1?arch=x86_64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                  "product_id": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/buildah-tests@1.43.3-2.el9_8.tuxcare.els1?arch=x86_64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
                "product": {
                  "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
                  "product_id": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/git-lfs@3.7.1-4.el9_8.3.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
                "product": {
                  "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
                  "product_id": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/runc@1.4.2-3.el9_8.tuxcare.els1?arch=aarch64&epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                "product": {
                  "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                  "product_id": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/skopeo-tests@1.22.2-8.el9_8.tuxcare.els1?arch=aarch64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                "product": {
                  "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                  "product_id": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/skopeo@1.22.2-8.el9_8.tuxcare.els1?arch=aarch64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                "product": {
                  "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                  "product_id": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/buildah@1.43.3-2.el9_8.tuxcare.els1?arch=aarch64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                "product": {
                  "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                  "product_id": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/buildah-tests@1.43.3-2.el9_8.tuxcare.els1?arch=aarch64&epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
                "product": {
                  "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
                  "product_id": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/git-lfs@3.7.1-4.el9_8.3.tuxcare.els1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.aarch64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-0:3.7.1-4.el9_8.3.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.x86_64"
        },
        "product_reference": "git-lfs-0:3.7.1-4.el9_8.3.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64"
        },
        "product_reference": "rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64"
        },
        "product_reference": "rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-39321",
      "notes": [
        {
          "category": "description",
          "text": "Processing an incomplete post-handshake message for a QUIC connection can cause a panic.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:git-lfs-0:3.7.1-4.el9_8.3.tuxcare.els1.x86_64"
        ],
        "known_affected": [
          "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.aarch64",
          "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.x86_64",
          "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
          "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64"
        ],
        "known_not_affected": [
          "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
          "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
          "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
          "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
          "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2023-39321"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/523039",
          "url": "https://go.dev/cl/523039"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/62266",
          "url": "https://go.dev/issue/62266"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ",
          "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2023-2044",
          "url": "https://pkg.go.dev/vuln/GO-2023-2044"
        },
        {
          "category": "external",
          "summary": "https://security.gentoo.org/glsa/202311-09",
          "url": "https://security.gentoo.org/glsa/202311-09"
        },
        {
          "category": "external",
          "summary": "https://security.netapp.com/advisory/ntap-20231020-0004/",
          "url": "https://security.netapp.com/advisory/ntap-20231020-0004/"
        }
      ],
      "release_date": "2023-09-08T17:15:00Z",
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-10-15T02:54:42.621154Z",
          "details": "Affected",
          "product_ids": [
            "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.aarch64",
            "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.x86_64",
            "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
            "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.aarch64",
            "AlmaLinux-9.8:git-lfs-0:3.7.1-4.el9_8.3.x86_64",
            "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.aarch64",
            "Rocky Linux-9.8:rocky/git-lfs-0:3.7.1-4.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        },
        {
          "category": "impact",
          "date": "2026-10-15T17:36:10.288462Z",
          "details": "The runc package for TuxCare 9.8 ESU is not affected by CVE-2023-39321. The flaw is in the Go standard library's crypto/tls QUIC handling, which is not part of runc's own code, and no crypto/tls functions are present in the shipped runc binary.",
          "product_ids": [
            "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:runc-4:1.4.2-3.el9_8.tuxcare.els1.x86_64"
          ]
        },
        {
          "category": "impact",
          "date": "2026-10-15T17:36:06.821539Z",
          "details": "The skopeo package for TuxCare 9.8 ESU is not affected by CVE-2023-39321. The flaw affects QUIC connection handling in the Go standard library's crypto/tls package, and that code is not linked into the skopeo binary shipped for this platform, which is built with Go 1.26.7.",
          "product_ids": [
            "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
            "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:skopeo-2:1.22.2-8.el9_8.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:skopeo-tests-2:1.22.2-8.el9_8.tuxcare.els1.x86_64"
          ]
        },
        {
          "category": "impact",
          "date": "2026-10-15T17:37:25.725528Z",
          "details": "The buildah package for TuxCare 9.8 ESU is not affected by CVE-2023-39321. The shipped buildah binary is a statically linked Go program in which the crypto/tls QUIC client and server entry points are absent, so the affected QUIC post-handshake message handling cannot be reached at runtime.",
          "product_ids": [
            "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
            "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:buildah-2:1.43.3-2.el9_8.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:buildah-tests-2:1.43.3-2.el9_8.tuxcare.els1.x86_64"
          ]
        }
      ]
    }
  ]
}