CVE-2023-0229
Fixed in a distro release EPSS <1%CVSS 6.3
A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.
Products: redhat openshift
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/openshift/apiserver-library-go | 0.0.0-20230120221150-cefee9e0162b |
| Go | github.com/openshift/apiserver-library-go | 0.0.0-20230119093715-30f75d79e424 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 4.12 | microshift | 0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8 |
| Red Hat openshift 4.12 | microshift-networking | 0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8 |
| Red Hat openshift 4.12 | microshift-release-info | 0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8 |
| Red Hat openshift 4.12 | microshift-selinux | 0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8 |
| Red Hat openshift 4.13 | buildah | 1:1.29.1-1.rhaos4.13.el9 |
| Red Hat openshift 4.13 | buildah-debuginfo | 1:1.29.1-1.rhaos4.13.el9 |
| Red Hat openshift 4.13 | buildah-debugsource | 1:1.29.1-1.rhaos4.13.el9 |
| Red Hat openshift 4.13 | buildah-tests | 1:1.29.1-1.rhaos4.13.el9 |
| Red Hat openshift 4.13 | buildah-tests-debuginfo | 1:1.29.1-1.rhaos4.13.el9 |
| Red Hat openshift 4.13 | cri-o | 0:1.26.3-3.rhaos4.13.git641290e.el9 |
| Red Hat openshift 4.13 | cri-o-debuginfo | 0:1.26.3-3.rhaos4.13.git641290e.el9 |
| Red Hat openshift 4.13 | cri-o-debugsource | 0:1.26.3-3.rhaos4.13.git641290e.el9 |
| Red Hat openshift 4.13 | haproxy | 0:2.2.24-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | haproxy-debugsource | 0:2.2.24-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | haproxy22 | 0:2.2.24-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | haproxy22-debuginfo | 0:2.2.24-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | openshift | 0:4.13.0-202304211155.p0.gb404935.assembly.stream.el8 |
| Red Hat openshift 4.13 | openshift | 0:4.13.0-202304211155.p0.gb404935.assembly.stream.el9 |
| Red Hat openshift 4.13 | openshift-clients | 0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8 |
| Red Hat openshift 4.13 | openshift-clients | 0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el9 |
| Red Hat openshift 4.13 | openshift-clients-redistributable | 0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8 |
| Red Hat openshift 4.13 | openshift-clients-redistributable | 0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el9 |
| Red Hat openshift 4.13 | openshift-hyperkube | 0:4.13.0-202304211155.p0.gb404935.assembly.stream.el8 |
| Red Hat openshift 4.13 | openshift-hyperkube | 0:4.13.0-202304211155.p0.gb404935.assembly.stream.el9 |
| Red Hat openshift 4.13 | podman | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman | 3:4.4.1-3.rhaos4.13.el9 |
| Red Hat openshift 4.13 | podman-catatonit | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman-catatonit-debuginfo | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman-debuginfo | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman-debuginfo | 3:4.4.1-3.rhaos4.13.el9 |
| Red Hat openshift 4.13 | podman-debugsource | 3:4.4.1-3.rhaos4.13.el9 |
| Red Hat openshift 4.13 | podman-debugsource | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman-docker | 3:4.4.1-3.rhaos4.13.el9 |
| Red Hat openshift 4.13 | podman-docker | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman-gvproxy | 3:4.4.1-3.rhaos4.13.el9 |
| Red Hat openshift 4.13 | podman-gvproxy | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman-gvproxy-debuginfo | 3:4.4.1-3.rhaos4.13.el9 |
| Red Hat openshift 4.13 | podman-gvproxy-debuginfo | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman-plugins | 3:4.4.1-3.rhaos4.13.el9 |
| Red Hat openshift 4.13 | podman-plugins | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman-plugins-debuginfo | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman-plugins-debuginfo | 3:4.4.1-3.rhaos4.13.el9 |
| Red Hat openshift 4.13 | podman-remote | 3:4.4.1-3.rhaos4.13.el9 |
| Red Hat openshift 4.13 | podman-remote | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman-remote-debuginfo | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | podman-remote-debuginfo | 3:4.4.1-3.rhaos4.13.el9 |
| Red Hat openshift 4.13 | podman-tests | 3:4.4.1-3.rhaos4.13.el9 |
| Red Hat openshift 4.13 | podman-tests | 3:4.4.1-3.rhaos4.13.el8 |
| Red Hat openshift 4.13 | python-werkzeug | 0:1.0.1-3.el8ost |
| Red Hat openshift 4.13 | python3-werkzeug | 0:1.0.1-3.el8ost |
| Red Hat openshift 4.13 | skopeo | 2:1.10.0-1.rhaos4.13.el9 |
| Red Hat openshift 4.13 | skopeo-debuginfo | 2:1.10.0-1.rhaos4.13.el9 |
| Red Hat openshift 4.13 | skopeo-debugsource | 2:1.10.0-1.rhaos4.13.el9 |
| Red Hat openshift 4.13 | skopeo-tests | 2:1.10.0-1.rhaos4.13.el9 |
| Red Hat openshift ironic 4.13 | python-werkzeug | 0:2.0.3-4.el9 |
| Red Hat openshift ironic 4.13 | python3-werkzeug | 0:2.0.3-4.el9 |