Home / mailings [RHSA-2023:2029-01] Moderate: OpenShift Security Profiles Operator bug fix update
Posted on 10 May 2023
RedHat===================================================================== Red Hat Security Advisory
Synopsis: Moderate: OpenShift Security Profiles Operator bug fix update
Advisory ID: RHSA-2023:2029-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2023:2029
Issue date: 2023-05-10
CVE Names: CVE-2023-0475 CVE-2023-25173
=====================================================================
1. Summary:
An updated Security Profiles Operator image that fixes various bugs is now
available for the Red Hat OpenShift Enterprise 4 catalog.
2. Description:
The OpenShift Security Profiles Operator v0.7.0 is now available. See the
documentation for bug fix information:
https://docs.openshift.com/container-platform/4.12/security/security_profiles_operator/spo-release-notes.html
3. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied. For details on how to apply this
update, refer to:
https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
4. Bugs fixed (https://bugzilla.redhat.com/):
2170844 - CVE-2023-0475 go-getter: go-getter vulnerable to denial of service via malicious compressed archive
2174485 - CVE-2023-25173 containerd: Supplementary groups are not set up properly
5. JIRA issues fixed (https://issues.jboss.org/):
OCPBUGS-10045 - The spod pods crash with rhel9 os due to "error parsing semanage configuration file"
OCPBUGS-12879 - selinux: Allow using other container-selinux policy templates than container
6. References:
https://access.redhat.com/security/cve/CVE-2023-0475
https://access.redhat.com/security/cve/CVE-2023-25173
https://access.redhat.com/security/updates/classification/#moderate
7. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
