Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/openshift/apiserver-library-go < 0.0.0-20230621
Fixed in
0.0.0-20230621· Vendor fix available
Issue
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
Recommended action: Upgrade to 0.0.0-20230621 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/openshift/apiserver-library-go < 0.0.0-20230120221150-cefee9e0162b
Fixed in
0.0.0-20230120221150-cefee9e0162b· Vendor fix available
Issue
A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.
Recommended action: Upgrade to 0.0.0-20230120221150-cefee9e0162b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.