{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "exfatprogs allows out-of-bounds memory access",
    "tracking": {
      "current_release_date": "2026-07-28T07:33:29+00:00",
      "generator": {
        "date": "2026-07-28T07:33:29+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.1.0"
        }
      },
      "id": "CVE-2023-45897",
      "initial_release_date": "2023-10-28T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-07-28T07:33:29+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 9.9",
            "product": {
              "name": "Red Hat Enterprise Linux 9.9",
              "product_id": "rhel-9",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:enterprise_linux:9"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 9.4",
            "product": {
              "name": "Red Hat Enterprise Linux 9.4",
              "product_id": "rhel-9.4.0::baseos",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 9.4",
            "product": {
              "name": "Red Hat Enterprise Linux 9.4",
              "product_id": "rhel-br-9.4.0::baseos",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
              }
            }
          },
          {
            "category": "product_version",
            "name": "exfatprogs",
            "product": {
              "name": "exfatprogs",
              "product_id": "exfatprogs-0:1.2.2-2.el9",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/exfatprogs@1.2.2-2.el9?epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "exfatprogs",
            "product": {
              "name": "exfatprogs",
              "product_id": "exfatprogs-0:1.2.2-2.el9.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/exfatprogs@1.2.2-2.el9?arch=src&epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "exfatprogs-debuginfo",
            "product": {
              "name": "exfatprogs-debuginfo",
              "product_id": "exfatprogs-debuginfo",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/exfatprogs-debuginfo"
              }
            }
          },
          {
            "category": "product_version",
            "name": "exfatprogs-debugsource",
            "product": {
              "name": "exfatprogs-debugsource",
              "product_id": "exfatprogs-debugsource",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/exfatprogs-debugsource"
              }
            }
          },
          {
            "category": "product_version",
            "name": "exfatprogs",
            "product": {
              "name": "exfatprogs",
              "product_id": "exfatprogs.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/exfatprogs?arch=src"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exfatprogs-0:1.2.2-2.el9 as a component of Red Hat Enterprise Linux 9.4",
          "product_id": "rhel-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9"
        },
        "product_reference": "exfatprogs-0:1.2.2-2.el9",
        "relates_to_product_reference": "rhel-9.4.0::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exfatprogs-0:1.2.2-2.el9 as a component of Red Hat Enterprise Linux 9.4",
          "product_id": "rhel-br-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9"
        },
        "product_reference": "exfatprogs-0:1.2.2-2.el9",
        "relates_to_product_reference": "rhel-br-9.4.0::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exfatprogs-0:1.2.2-2.el9.src as a component of Red Hat Enterprise Linux 9.4",
          "product_id": "rhel-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9.src"
        },
        "product_reference": "exfatprogs-0:1.2.2-2.el9.src",
        "relates_to_product_reference": "rhel-9.4.0::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exfatprogs-0:1.2.2-2.el9.src as a component of Red Hat Enterprise Linux 9.4",
          "product_id": "rhel-br-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9.src"
        },
        "product_reference": "exfatprogs-0:1.2.2-2.el9.src",
        "relates_to_product_reference": "rhel-br-9.4.0::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exfatprogs-debuginfo as a component of Red Hat Enterprise Linux 9.4",
          "product_id": "rhel-9.4.0::baseos:exfatprogs-debuginfo"
        },
        "product_reference": "exfatprogs-debuginfo",
        "relates_to_product_reference": "rhel-9.4.0::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exfatprogs-debuginfo as a component of Red Hat Enterprise Linux 9.4",
          "product_id": "rhel-br-9.4.0::baseos:exfatprogs-debuginfo"
        },
        "product_reference": "exfatprogs-debuginfo",
        "relates_to_product_reference": "rhel-br-9.4.0::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exfatprogs-debugsource as a component of Red Hat Enterprise Linux 9.4",
          "product_id": "rhel-9.4.0::baseos:exfatprogs-debugsource"
        },
        "product_reference": "exfatprogs-debugsource",
        "relates_to_product_reference": "rhel-9.4.0::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exfatprogs-debugsource as a component of Red Hat Enterprise Linux 9.4",
          "product_id": "rhel-br-9.4.0::baseos:exfatprogs-debugsource"
        },
        "product_reference": "exfatprogs-debugsource",
        "relates_to_product_reference": "rhel-br-9.4.0::baseos"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exfatprogs.src as a component of Red Hat Enterprise Linux 9.9",
          "product_id": "rhel-9:exfatprogs.src"
        },
        "product_reference": "exfatprogs.src",
        "relates_to_product_reference": "rhel-9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45897",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2023-10-30T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "rhel-9.4.0::baseos:exfatprogs-debuginfo",
            "rhel-9.4.0::baseos:exfatprogs-debugsource",
            "rhel-br-9.4.0::baseos:exfatprogs-debuginfo",
            "rhel-br-9.4.0::baseos:exfatprogs-debugsource"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Exfatprogs, a userspace utility that contains all of the standard utilities for creating, fixing, and debugging the exfat filesystem in the linux system.This issue may allow out-of-bounds memory access such as in read_file_dentry_set. To exploit this vulnerability, the attacker must possess authorization with privileges granting basic user capabilities, and can achieve out-of-bounds memory access.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "rhel-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9",
          "rhel-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9.src",
          "rhel-br-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9",
          "rhel-br-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9.src"
        ],
        "known_affected": [
          "rhel-9:exfatprogs.src"
        ],
        "known_not_affected": [
          "rhel-9.4.0::baseos:exfatprogs-debuginfo",
          "rhel-9.4.0::baseos:exfatprogs-debugsource",
          "rhel-br-9.4.0::baseos:exfatprogs-debuginfo",
          "rhel-br-9.4.0::baseos:exfatprogs-debugsource"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-45897"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45897"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-45897"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "rhel-9:exfatprogs.src"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2024-04-30T10:03:53+00:00",
          "details": "Apply advisory RHSA-2024:2437 as per vendors instructions.",
          "product_ids": [
            "rhel-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9",
            "rhel-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9.src",
            "rhel-br-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9",
            "rhel-br-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9.src"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2437"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "rhel-9:exfatprogs.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM"
          },
          "products": [
            "rhel-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9",
            "rhel-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9.src",
            "rhel-9.4.0::baseos:exfatprogs-debuginfo",
            "rhel-9.4.0::baseos:exfatprogs-debugsource",
            "rhel-9:exfatprogs.src",
            "rhel-br-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9",
            "rhel-br-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9.src",
            "rhel-br-9.4.0::baseos:exfatprogs-debuginfo",
            "rhel-br-9.4.0::baseos:exfatprogs-debugsource"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "rhel-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9",
            "rhel-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9.src",
            "rhel-9.4.0::baseos:exfatprogs-debuginfo",
            "rhel-9.4.0::baseos:exfatprogs-debugsource",
            "rhel-9:exfatprogs.src",
            "rhel-br-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9",
            "rhel-br-9.4.0::baseos:exfatprogs-0:1.2.2-2.el9.src",
            "rhel-br-9.4.0::baseos:exfatprogs-debuginfo",
            "rhel-br-9.4.0::baseos:exfatprogs-debugsource"
          ]
        }
      ],
      "title": "exfatprogs allows out-of-bounds memory access"
    }
  ]
}