Red Hat OpenShift: CVE-2023-0229: openshift/apiserver-library-go: Bypass of SCC seccomp profile restrictions

Red Hat OpenShift: CVE-2023-0229: openshift/apiserver-library-go: Bypass of SCC seccomp profile restrictions

Severity

7

CVSS

(AV:N/AC:L/Au:S/C:P/I:P/A:P)

Published

01/26/2023

Created

03/13/2023

Added

03/13/2023

Modified

01/30/2025

Description

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.

Solution(s)

• linuxrpm-upgrade-microshift
• linuxrpm-upgrade-openshift

References

• https://attackerkb.com/topics/cve-2023-0229
• CVE - 2023-0229
• RHSA-2023:1325