RedHat: RHSA-2023-2029:01 Moderate: OpenShift Security Profiles Operator
Summary
The OpenShift Security Profiles Operator v0.7.0 is now available. See the
documentation for bug fix information:
https://docs.openshift.com/container-platform/4.12/security/security_profiles_operator/spo-release-notes.html
Summary
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied. For details on how to apply this
update, refer to:
https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
References
https://access.redhat.com/security/cve/CVE-2023-0475 https://access.redhat.com/security/cve/CVE-2023-25173 https://access.redhat.com/security/updates/classification/#moderate
Package List
Topic
An updated Security Profiles Operator image that fixes various bugs is nowavailable for the Red Hat OpenShift Enterprise 4 catalog.
Topic
Relevant Releases Architectures
Bugs Fixed
2170844 - CVE-2023-0475 go-getter: go-getter vulnerable to denial of service via malicious compressed archive
2174485 - CVE-2023-25173 containerd: Supplementary groups are not set up properly
5. JIRA issues fixed (https://issues.redhat.com/):
OCPBUGS-10045 - The spod pods crash with rhel9 os due to "error parsing semanage configuration file"
OCPBUGS-12879 - selinux: Allow using other container-selinux policy templates than container
