Advisory Types
CIQ groups its advisories by identifier prefix. The prefix tells you what kind of change the advisory describes and which package set it applies to.
Rocky Linux clone advisories use the upstream YYYY:NNNN numbering, for example CRLSA-2025:9330. CIQ product advisories (CIQSA) currently use a product-scoped identifier of the form CIQSA-LTS-9-6-2026:NNNN and are transitioning toward a CIQSA-YYYY:NNNN form, so treat the exact CIQSA format as subject to change.
Advisory identifiers
| Identifier | Type | Description |
|---|---|---|
CRLSA | Security Advisory | Security fixes for CIQ's Rocky Linux builds, transformed from Rocky Linux Security Advisories (RLSA). |
CRXSA | Kernel Security Advisory | Kernel security fixes for CIQ's Rocky Linux builds, transformed from Rocky Linux RXSA advisories (older 8.x and 9.x point releases). |
CRLBA | Bug Fix Advisory | Bug fixes for CIQ's Rocky Linux builds, transformed from Rocky Linux Bug Advisories (RLBA). |
CRLEA | Enhancement Advisory | Enhancements for CIQ's Rocky Linux builds, transformed from Rocky Linux Enhancement Advisories (RLEA). |
CIQSA | CIQ Security Advisory | Security advisories for CIQ products that extend beyond standard Rocky Linux, including LTS releases, FIPS builds, and CIQ Bridge. |
CIQ clones the Rocky Linux advisories that have one or more associated CVEs. Security advisories (RLSA, RXSA) are cloned comprehensively, while only the subset of bug fix (RLBA) and enhancement (RLEA) advisories that reference CVEs is cloned. Most upstream Rocky bug fix and enhancement advisories therefore have no CIQ equivalent. Where a clone exists, its number matches the upstream advisory.
Severity
Security advisories carry a severity rating based on the impact of the underlying CVEs. The rating scale depends on the advisory's source:
- Rocky Linux clones (
CRLSA,CRXSA,CRLBA,CRLEA) use the Red Hat style ratings inherited from the Rocky Enterprise Software Foundation: Critical, Important, Moderate, and Low. - CIQ product advisories (
CIQSA) currently use CVSS-derived ratings: Critical, High, Medium, and Low.
The errata metadata delivered to package managers normalizes the CVSS-style ratings to the Red Hat style (High becomes Important, Medium becomes Moderate), so the same CIQSA advisory can read High in its CSAF document and Important in dnf. The authoritative rating for a given advisory is the one published in the CIQ Security Advisories Portal.