Errata

Errata are the machine-readable records that describe which advisories fix which CVEs, in which packages, and at which versions. Distributing errata in standard formats lets package managers and vulnerability scanners map the packages installed on a system to known vulnerabilities and report accurate status, rather than flagging a package as vulnerable after the fix has already been applied.

Formats

• CSAF 2.0: the OASIS Common Security Advisory Framework, a standard structured format for security advisories.
• VEX: Vulnerability Exploitability eXchange statements record whether a specific product is affected by a given CVE, which lets scanners suppress findings that do not apply to the CIQ build you run.

How to consume errata

How you obtain errata depends on the tool:

• Package managers (dnf, yum): errata metadata (updateinfo) ships in the CIQ Depot repositories you install from. Once a host is enrolled in its Depot repositories, commands such as dnf updateinfo and security-only updates work against that metadata, with no separate feed to configure.
• Vulnerability scanners and automation: CIQ publishes CSAF 2.0 and VEX documents to the public ctrliq/advisories repository under csaf/, updated daily. Rocky Linux clone advisories are under csaf/advisories/rocky/, CIQ product advisories under csaf/advisories/ciq/, and VEX data under csaf/vex/. This is also the source that the CIQ Security Advisories Portal ingests.

Errata by product

Errata coverage spans several CIQ products:

• CIQ's Rocky Linux builds: errata for the packages CIQ ships, keyed to the advisory types.
• CIQ Bridge: errata for CentOS 7.9, published so that package managers and scanners report accurate status after upstream stopped. See Security and Errata.
• Ascender Ledger Pro: builds an errata view by comparing the Enterprise Linux CVE data with the packages installed on your hosts, covering RHEL, Rocky, Alma, and Oracle Linux. See Errata.