{
  "repository": "opencontainers/runc",
  "commit_source": "git_tag_resolution",
  "commit_sha": "491b69bab9fa206b984fb26ba07d3110d62e671f",
  "submitted_target": {
    "target_kind": "git_tag",
    "version": "v1.3.5",
    "commit_sha": "488fc13e1f2d3d73ec36d829fdf2c98e47dc5ae8",
    "ref": "refs/tags/v1.3.5",
    "display": "runc v1.3.5 official amd64 release binary"
  },
  "variant_target": {
    "target_kind": "git_tag",
    "version": "v1.3.6",
    "commit_sha": "491b69bab9fa206b984fb26ba07d3110d62e671f",
    "ref": "refs/tags/v1.3.6",
    "display": "runc v1.3.6 official amd64 release binary"
  },
  "notes": "The vulnerable and fixed binaries were downloaded from the official GitHub releases. The corresponding tag commits were resolved in the cloned bare repository at /data/pruva/project-cache/517c163c-d303-4c5e-8999-e2db5251d636/repo-mirrors/runc.git."
}