An OpenShift Security Profiles Operator bug fix update has been released.

RHSA-2023:2029-01: Moderate: OpenShift Security Profiles Operator bug fix update

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: OpenShift Security Profiles Operator bug fix update
Advisory ID: RHSA-2023:2029-01
Product: Red Hat OpenShift Enterprise
Advisory URL:   https://access.redhat.com/errata/RHSA-2023:2029
Issue date: 2023-05-10
CVE Names: CVE-2023-0475 CVE-2023-25173
=====================================================================

1. Summary:

An updated Security Profiles Operator image that fixes various bugs is now
available for the Red Hat OpenShift Enterprise 4 catalog.

2. Description:

The OpenShift Security Profiles Operator v0.7.0 is now available. See the
documentation for bug fix information:

  https://docs.openshift.com/container-platform/4.12/security/security_profiles_operator/spo-release-notes.html

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied. For details on how to apply this
update, refer to:

  https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

4. Bugs fixed (  https://bugzilla.redhat.com/):

2170844 - CVE-2023-0475 go-getter: go-getter vulnerable to denial of service via malicious compressed archive
2174485 - CVE-2023-25173 containerd: Supplementary groups are not set up properly

5. JIRA issues fixed (  https://issues.jboss.org/):

OCPBUGS-10045 - The spod pods crash with rhel9 os due to "error parsing semanage configuration file"
OCPBUGS-12879 - selinux: Allow using other container-selinux policy templates than container

6. References:

  https://access.redhat.com/security/cve/CVE-2023-0475
  https://access.redhat.com/security/cve/CVE-2023-25173
  https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is . More contact
details at   https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.