{"id":"CVE-2023-0229","aliases":["EUVD-2023-0333","GHSA-5465-xc2j-6p84","GO-2023-1549","RHBA-2023:1037","RHSA-2023:1325"],"status":"published","title":"github.com/openshift/apiserver-library-go Improper Input Validation vulnerability","description":"A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to \"unconfined.\" By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is \"runtime/default,\" allowing users to disable seccomp for pods they can create and modify.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00665,"percentile":0.5207,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2023-01-25T00:00:00Z","modified":"2026-10-20T10:01:39Z","fixes":[{"ecosystem":"Go","package":"github.com/openshift/apiserver-library-go","fixed_in":["0.0.0-20230120221150-cefee9e0162b","0.0.0-20230119093715-30f75d79e424"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:openshift:4.12::el8","package":"microshift","fixed_in":["0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.12::el8","package":"microshift-networking","fixed_in":["0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.12::el8","package":"microshift-release-info","fixed_in":["0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.12::el8","package":"microshift-selinux","fixed_in":["0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/openshift/apiserver-library-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20230120221150-cefee9e0162b"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openshift/apiserver-library-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20230120221150-cefee9e0162b"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openshift/apiserver-library-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20230119093715-30f75d79e424"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"microshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"microshift-networking","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"microshift-release-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"microshift-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.6-202303012057.p0.g50997a2.assembly.4.12.6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.29.1-1.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.29.1-1.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.29.1-1.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.29.1-1.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.29.1-1.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202304211155.p0.gb404935.assembly.stream.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202304211155.p0.gb404935.assembly.stream.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202304211155.p0.gb404935.assembly.stream.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202304211155.p0.gb404935.assembly.stream.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.3-3.rhaos4.13.git641290e.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.3-3.rhaos4.13.git641290e.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.3-3.rhaos4.13.git641290e.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.0-1.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.0-1.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.0-1.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.0-1.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"haproxy22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el8"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.rhaos4.13.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-3.el8ost"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"python3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-3.el8ost"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.13::el9","package":"python-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-4.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.13::el9","package":"python3-werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-4.el9"}]}],"bundled":13}],"products":[{"vendor":"redhat","product":"openshift"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2160349","tags":["x_transferred","Issue Tracking","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0229","tags":["advisory"]},{"url":"https://github.com/openshift/apiserver-library-go/pull/97","tags":["web","fix"]},{"url":"https://github.com/openshift/apiserver-library-go/commit/30f75d79e424ca462c6de53ee8b93f91183763e6","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-5465-xc2j-6p84","tags":["advisory"]},{"url":"github.com/openshift/apiserver-library-go","tags":["package"]},{"url":"https://access.redhat.com/errata/RHBA-2023:1037","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8077","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_1037.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0229","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0229","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1325","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121453","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2160808","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2161274","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168256","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178358","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178488","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178492","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1325.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2990","tags":["advisory"]},{"url":"https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3259","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3259","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3259","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-27191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064702","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-27191","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27191","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/-cp44ypCT5s/m/wmegxkLiAQAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41717","tags":["advisory"]},{"url":"https://go.dev/cl/455635","tags":["article"]},{"url":"https://go.dev/cl/455717","tags":["article"]},{"url":"https://go.dev/issue/56350","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2022-1144","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2203008","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41722","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41722","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41723","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41723","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vvpx-j8f3-3w6h","tags":["advisory"]},{"url":"https://go.dev/cl/468135","tags":["article"]},{"url":"https://go.dev/cl/468295","tags":["article"]},{"url":"https://go.dev/issue/57855","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1571","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2023-1571.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41724","tags":["advisory"]},{"url":"https://go.dev/cl/468125","tags":["article"]},{"url":"https://go.dev/issue/58001","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1570","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41725","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41725","tags":["advisory"]},{"url":"https://go.dev/cl/468124","tags":["article"]},{"url":"https://go.dev/issue/58006","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1569","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0056","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0056","tags":["advisory"]},{"url":"https://github.com/haproxy/haproxy/issues/1972","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0778","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0778","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qwqv-rqgf-8qh8","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25577","tags":["advisory"]},{"url":"https://github.com/pallets/werkzeug/commit/517cac5a804e8c4dc4ed038bb20dacd038e7a9f1","tags":["article"]},{"url":"https://github.com/pallets/werkzeug/releases/tag/2.2.3","tags":["article"]},{"url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-xg9f-g7g7-2323","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25725","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25725","tags":["advisory"]},{"url":"https://www.haproxy.com/blog/february-2023-header-parser-fixed/","tags":["article"]},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg43229.html","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2023-0229","description":"A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to \"unconfined.\" By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is \"runtime/default,\" allowing users to disable seccomp for pods they can create and modify.","status":"published","published":"2023-01-25T00:00:00Z","modified":"2025-04-01T15:07:42.482Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:35.256261Z"}],"euvd":[{"id":"EUVD-2023-0333","description":"A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to \"unconfined.\" By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is \"runtime/default,\" allowing users to disable seccomp for pods they can create and modify.","status":"published","published":"2023-01-25T00:00:00Z","modified":"2025-04-01T15:07:42Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:45.844316Z"}],"ghsa":[{"id":"GHSA-5465-xc2j-6p84","title":"github.com/openshift/apiserver-library-go Improper Input Validation vulnerability","description":"A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to \"unconfined.\" By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is \"runtime/default,\" allowing users to disable seccomp for pods they can create and modify.","status":"published","published":"2023-01-26T21:30:20Z","modified":"2024-05-20T21:44:02Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2023-0229","description":"A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to \"unconfined.\" By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is \"runtime/default,\" allowing users to disable seccomp for pods they can create and modify.","status":"published","published":"2023-01-26T21:18:06.9Z","modified":"2026-06-17T05:25:04.51Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"GHSA-5465-xc2j-6p84","title":"github.com/openshift/apiserver-library-go Improper Input Validation vulnerability","description":"A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to \"unconfined.\" By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is \"runtime/default,\" allowing users to disable seccomp for pods they can create and modify.","status":"published","published":"2023-01-26T21:30:20Z","modified":"2024-05-20T21:44:13Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"RHBA-2023:1037","title":"Red Hat Bug Fix Advisory: Red Hat build of MicroShift 4.12.6 bug fix and enhancement update","status":"published","published":"2024-09-16T10:50:56Z","modified":"2026-06-04T10:01:28Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2023:1325","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update","status":"published","published":"2024-10-02T00:13:13Z","modified":"2026-10-20T10:01:39Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"GO-2023-1549","title":"Improper input validation in github.com/openshift/apiserver-library-go","description":"Low-privileged users can set the seccomp profile for pods they control to \"unconfined.\"\n\nBy default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is \"runtime/default,\" allowing users to disable seccomp for pods they can create and modify.","status":"published","published":"2023-02-16T21:56:10Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}