CVE and Security Advisories

CIQ tracks Common Vulnerabilities and Exposures (CVEs) that affect the packages it ships and publishes advisories that record how each one is addressed. An advisory identifies the affected packages, the CVEs it resolves, and the fixed package versions, so you can confirm whether a given vulnerability is remediated in the builds you run.

Where advisories are published

CIQ publishes advisories through the CIQ Security Advisories Portal, a public lookup tool at portal.ciq.com/cve. From there you can:

• Browse and search advisories by advisory ID or title.
• Filter by severity and other criteria, and export results as CSV.
• See the CVEs each advisory resolves, its remediation date, and the priority packages affected.

Advisories are grouped by identifier type. See Advisory Types for what each identifier (CRLSA, CRXSA, CRLBA, CRLEA, CIQSA) means and which products it applies to.

Consuming advisories in automation

For programmatic use, CIQ publishes the underlying CSAF 2.0 and VEX documents to the public ctrliq/advisories repository, updated daily, and ships errata metadata to the CIQ Depot repositories for package managers. See Errata for how vulnerability scanners and package managers consume each.

Product-specific CVE resources

Some products provide their own CVE tooling in addition to the shared advisories:

• CIQ Bridge: signed CVE remediation and errata for CentOS 7.9. See Security and Errata.
• Ascender Ledger Pro: an in-product view of CVE exposure across your Enterprise Linux hosts. See Errata.