MitM attack in OpenShift Container Platform 4.12

1) Inadequate Encryption Strength

EUVDB-ID: #VU78005

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-3089

CWE-ID: CWE-326 - Inadequate Encryption Strength

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists within the OpenShift container platform configuration with enabled FIPS mode, which resulted in usage of not validated cryptographic modules. A remote attacker can perform various attacks against not validated cryptographic modules and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.12.0 - 4.12.22

ovn23.06 (Red Hat package): before 23.06.0-13.el8fdp

openshift4-aws-iso (Red Hat package): before 4.12.0-202306230041.p0.gd2acdd5.assembly.stream.el8

openshift-kuryr (Red Hat package): before 4.12.0-202306230041.p0.g31dd228.assembly.stream.el8

openshift-ansible (Red Hat package): before 4.12.0-202306230041.p0.g74dc7b3.assembly.stream.el8

container-selinux (Red Hat package): before 2.215.0-1.rhaos4.12.el8

openshift-clients (Red Hat package): before 4.12.0-202306230041.p0.gea7c11a.assembly.stream.el9

openshift (Red Hat package): before 4.12.0-202306251254.p0.gc43ddea.assembly.stream.el9

External links

http://access.redhat.com/errata/RHSA-2023:3924

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.