Every CVE Search/ Get API key

CVE-2023-0229

github.com/openshift/apiserver-library-go Improper Input Validation vulnerability

6.3 MediumFix available

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.66%Down 0.2 points since Jan 26, 2023
90%50%10%1%

What each source reports

NVD Score used 6.3

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.

Record
CVE-2023-0229
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-20
Updated
2026-11-02
CVE List 6.3

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.

Record
CVE-2023-0229
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2023-0333 6.3

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.

Record
EUVD-2023-0333
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-5465-xc2j-6p84 6.3

github.com/openshift/apiserver-library-go Improper Input Validation vulnerability

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.

Record
GHSA-5465-xc2j-6p84
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-5465-xc2j-6p84 6.3

github.com/openshift/apiserver-library-go Improper Input Validation vulnerability

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.

Record
GHSA-5465-xc2j-6p84
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-20
Updated
2026-11-02
OSVRHBA-2023:1037 6.3

Red Hat Bug Fix Advisory: Red Hat build of MicroShift 4.12.6 bug fix and enhancement update

Record
RHBA-2023:1037
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2023:1325 8.2

Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update

Record
RHSA-2023:1325
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Updated
2026-11-02
OSVGO-2023-1549 No score

Improper input validation in github.com/openshift/apiserver-library-go

Low-privileged users can set the seccomp profile for pods they control to "unconfined."

By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.

Record
GO-2023-1549
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/openshift/apiserver-library-go
Go
 before 0.0.0-20230120221150-cefee9e0162b
0.0.0-20230120221150-cefee9e0162b
github.com/openshift/apiserver-library-go
Go
 before 0.0.0-20230119093715-30f75d79e424
0.0.0-20230119093715-30f75d79e424
microshift
Red Hat:openshift:4.12::el8
 before 0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8
0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8
microshift-networking
Red Hat:openshift:4.12::el8
 before 0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8
0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8
microshift-release-info
Red Hat:openshift:4.12::el8
 before 0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8
0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8
microshift-selinux
Red Hat:openshift:4.12::el8
 before 0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8
0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8
buildah
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 1:1.29.1-1.rhaos4.13.el9
1:1.29.1-1.rhaos4.13.el9
buildah-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 1:1.29.1-1.rhaos4.13.el9
1:1.29.1-1.rhaos4.13.el9
buildah-debugsource
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 1:1.29.1-1.rhaos4.13.el9
1:1.29.1-1.rhaos4.13.el9
buildah-tests
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 1:1.29.1-1.rhaos4.13.el9
1:1.29.1-1.rhaos4.13.el9
Show 48 moreShow less
Affected packages
PackageAffectedFixed
buildah-tests-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 1:1.29.1-1.rhaos4.13.el9
1:1.29.1-1.rhaos4.13.el9
openshift
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 0:4.13.0-202304211155.p0.gb404935.assembly.stream.el8
0:4.13.0-202304211155.p0.gb404935.assembly.stream.el8
openshift-hyperkube
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 0:4.13.0-202304211155.p0.gb404935.assembly.stream.el8
0:4.13.0-202304211155.p0.gb404935.assembly.stream.el8
openshift
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 0:4.13.0-202304211155.p0.gb404935.assembly.stream.el9
0:4.13.0-202304211155.p0.gb404935.assembly.stream.el9
openshift-hyperkube
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 0:4.13.0-202304211155.p0.gb404935.assembly.stream.el9
0:4.13.0-202304211155.p0.gb404935.assembly.stream.el9
openshift-clients
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8
0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8
openshift-clients-redistributable
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8
0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8
openshift-clients
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el9
0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el9
openshift-clients-redistributable
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el9
0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el9
cri-o
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 0:1.26.3-3.rhaos4.13.git641290e.el9
0:1.26.3-3.rhaos4.13.git641290e.el9
cri-o-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 0:1.26.3-3.rhaos4.13.git641290e.el9
0:1.26.3-3.rhaos4.13.git641290e.el9
cri-o-debugsource
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 0:1.26.3-3.rhaos4.13.git641290e.el9
0:1.26.3-3.rhaos4.13.git641290e.el9
skopeo
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 2:1.10.0-1.rhaos4.13.el9
2:1.10.0-1.rhaos4.13.el9
skopeo-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 2:1.10.0-1.rhaos4.13.el9
2:1.10.0-1.rhaos4.13.el9
skopeo-debugsource
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 2:1.10.0-1.rhaos4.13.el9
2:1.10.0-1.rhaos4.13.el9
skopeo-tests
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 2:1.10.0-1.rhaos4.13.el9
2:1.10.0-1.rhaos4.13.el9
haproxy
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 0:2.2.24-3.rhaos4.13.el8
0:2.2.24-3.rhaos4.13.el8
haproxy-debugsource
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 0:2.2.24-3.rhaos4.13.el8
0:2.2.24-3.rhaos4.13.el8
haproxy22
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 0:2.2.24-3.rhaos4.13.el8
0:2.2.24-3.rhaos4.13.el8
haproxy22-debuginfo
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 0:2.2.24-3.rhaos4.13.el8
0:2.2.24-3.rhaos4.13.el8
podman
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-catatonit
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-catatonit-debuginfo
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-debuginfo
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-debugsource
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-docker
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-gvproxy
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-gvproxy-debuginfo
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-plugins
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-plugins-debuginfo
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-remote
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-remote-debuginfo
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman-tests
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el8
3:4.4.1-3.rhaos4.13.el8
podman
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el9
3:4.4.1-3.rhaos4.13.el9
podman-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el9
3:4.4.1-3.rhaos4.13.el9
podman-debugsource
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el9
3:4.4.1-3.rhaos4.13.el9
podman-docker
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el9
3:4.4.1-3.rhaos4.13.el9
podman-gvproxy
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el9
3:4.4.1-3.rhaos4.13.el9
podman-gvproxy-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el9
3:4.4.1-3.rhaos4.13.el9
podman-plugins
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el9
3:4.4.1-3.rhaos4.13.el9
podman-plugins-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el9
3:4.4.1-3.rhaos4.13.el9
podman-remote
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el9
3:4.4.1-3.rhaos4.13.el9
podman-remote-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el9
3:4.4.1-3.rhaos4.13.el9
podman-tests
Red Hat:openshift:4.13::el9
From an advisory covering 13 CVEs
 before 3:4.4.1-3.rhaos4.13.el9
3:4.4.1-3.rhaos4.13.el9
python-werkzeug
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 0:1.0.1-3.el8ost
0:1.0.1-3.el8ost
python3-werkzeug
Red Hat:openshift:4.13::el8
From an advisory covering 13 CVEs
 before 0:1.0.1-3.el8ost
0:1.0.1-3.el8ost
python-werkzeug
Red Hat:openshift_ironic:4.13::el9
From an advisory covering 13 CVEs
 before 0:2.0.3-4.el9
0:2.0.3-4.el9
python3-werkzeug
Red Hat:openshift_ironic:4.13::el9
From an advisory covering 13 CVEs
 before 0:2.0.3-4.el9
0:2.0.3-4.el9

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-0229 is a medium vulnerability (CVSS 6.3) in Redhat Openshift, published January 25, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 52nd percentile. Fixed in github.com/openshift/apiserver-library-go 0.0.0-20230120221150-cefee9e0162b.

References

Show 83 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open