CVE-2023-0229: github.com/openshift/apiserver-library-go Improper Input Validation vulnerability

January 26, 2023 (updated February 8, 2023)

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to “unconfined.” By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is “runtime/default,” allowing users to disable seccomp for pods they can create and modify.

References

bugzilla.redhat.com/show_bug.cgi?id=2160349
github.com/advisories/GHSA-5465-xc2j-6p84
github.com/openshift/apiserver-library-go/commit/30f75d79e424ca462c6de53ee8b93f91183763e6
github.com/openshift/apiserver-library-go/pull/97
nvd.nist.gov/vuln/detail/CVE-2023-0229

Code Behaviors & Features

Detect and mitigate CVE-2023-0229 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →