Inadequate Encryption Strength in Red Hat OpenShift Container Platform - CVE-2023-3089

Vulnerability identifier: #VU78005

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-3089

CWE-ID: CWE-326

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists within the OpenShift container platform configuration with enabled FIPS mode, which resulted in usage of not validated cryptographic modules. A remote attacker can perform various attacks against not validated cryptographic modules and gain access to sensitive information.

Red Hat OpenShift Container Platform
OpenShift Serverless Client
Gatekeeper Operator
VolSync
Red Hat CodeReady Workspaces for OpenShift
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift Dev Spaces
OpenShift sandboxed containers
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Virtualization
crun-wasm (Red Hat package)
toolbox (Red Hat package)
wasmedge (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
coreos-installer (Red Hat package)
butane (Red Hat package)
containernetworking-plugins (Red Hat package)
runc (Red Hat package)
skopeo (Red Hat package)
openshift-serverless-clients (Red Hat package)
google-benchmark (Red Hat package)
crun (Red Hat package)
spdlog (Red Hat package)
gtest (Red Hat package)
buildah (Red Hat package)
cri-o (Red Hat package)
cri-tools (Red Hat package)
containers-common (Red Hat package)
conmon (Red Hat package)
nmstate (Red Hat package)
haproxy (Red Hat package)
ignition (Red Hat package)
container-selinux (Red Hat package)
jenkins (Red Hat package)
openvswitch3.1 (Red Hat package)
kata-containers (Red Hat package)
podman (Red Hat package)
catch (Red Hat package)
openshift-kuryr (Red Hat package)
openshift (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
jenkins-2-plugins (Red Hat package)
openshift4-aws-iso (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
rust-afterburn (Red Hat package)
fmt (Red Hat package)
openstack-ironic (Red Hat package)
ovn23.06 (Red Hat package)
ovn23.09 (Red Hat package)

Install updates from vendor's website.

Red Hat OpenShift Container Platform - addressed in versions 4.10.63, 4.11.44, 4.12.23, 4.13.5, 4.13.6, 4.13.8, 4.14.0
VolSync - addressed in versions 0.5.4, 0.6.3, 0.7.3
OpenShift sandboxed containers - update to 1.4.1
Red Hat OpenShift Serverless - update to 1.29.1
OpenShift Serverless Client - update to 1.29.1
Multicluster Engine for Kubernetes - addressed in versions 2.1.8, 2.2.7, 2.3.1
OpenShift Service Mesh - addressed in versions 2.2.8, 2.3.5, 2.4.1
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.6.7, 2.7.7, 2.8.1
Red Hat OpenShift Dev Spaces - update to 3.7.1
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.10.14, 4.11.9, 4.12.5, 4.13.1
OpenShift Virtualization - addressed in versions 4.11.6, 4.12.5, 4.13.3
crun-wasm (Red Hat package) - addressed in versions 0.0-3.rhaos4.14.el8, 1.8.5-3.rhaos4.14.el9
toolbox (Red Hat package) - update to 0.1.2-1.rhaos4.14.el9
wasmedge (Red Hat package) - update to 0.12.1-2.rhaos4.14.el9
golang-github-prometheus-promu (Red Hat package) - update to 0.15.0-15.1.gitd5383c5.el8
coreos-installer (Red Hat package) - addressed in versions 0.17.0-1.rhaos4.14.el8, 0.17.0-1.rhaos4.14.el9
butane (Red Hat package) - update to 0.19.0-1.1.rhaos4.14.el8
containernetworking-plugins (Red Hat package) - addressed in versions 1.0.1-6.rhaos4.11.el8, 1.0.1-8.rhaos4.13.el8, 1.0.1-11.1.rhaos4.14.el8
runc (Red Hat package) - addressed in versions 1.1.2-2.rhaos4.11.el8, 1.1.9-2.1.rhaos4.14.el8, 1.1.9-2.1.rhaos4.14.el9
skopeo (Red Hat package) - addressed in versions 1.2.4-1.1.el8, 1.5.2-4.rhaos4.11.el8, 1.11.2-10.1.rhaos4.14.el8, 1.11.2-10.1.rhaos4.14.el9
openshift-serverless-clients (Red Hat package) - update to 1.8.1-6.el8
google-benchmark (Red Hat package) - update to 1.8.2-1.el9
crun (Red Hat package) - addressed in versions 1.9.2-1.rhaos4.14.el8, 1.9.2-1.rhaos4.14.el9
spdlog (Red Hat package) - update to 1.12.0-1.rhaos4.14.el9
gtest (Red Hat package) - update to 1.13.0-1.el9
buildah (Red Hat package) - addressed in versions 1.19.9-1.1.el8, 1.23.4-3.rhaos4.11.el8, 1.29.1-10.1.rhaos4.14.el8, 1.29.1-10.1.rhaos4.14.el9
cri-o (Red Hat package) - addressed in versions 1.24.6-2.rhaos4.11.git4bfe15a.el8, 1.26.3-10.rhaos4.13.git78941bf.el8, 1.26.3-11.rhaos4.13.git78941bf.el9, 1.27.1-8.1.rhaos4.14.git3fecb83.el8, 1.27.1-8.1.rhaos4.14.git3fecb83.el9
cri-tools (Red Hat package) - addressed in versions 1.27.0-2.1.el8, 1.27.0-2.1.el9
containers-common (Red Hat package) - update to 1-51.rhaos4.14.el8
conmon (Red Hat package) - addressed in versions 2.1.2-3.rhaos4.11.el8, 2.1.7-3.1.rhaos4.14.el8, 2.1.7-3.1.rhaos4.14.el9
nmstate (Red Hat package) - addressed in versions 2.2.12-1.rhaos4.13.el8, 2.2.12-1.rhaos4.14.el8
haproxy (Red Hat package) - update to 2.6.13-1.rhaos4.14.el8
ignition (Red Hat package) - update to 2.16.2-1.1.rhaos4.14.el9
container-selinux (Red Hat package) - addressed in versions 2.215.0-1.rhaos4.12.el8, 2.215.0-1.rhaos4.13.el8, 2.221.0-1.rhaos4.14.el8, 2.221.0-2.rhaos4.14.el9
jenkins (Red Hat package) - update to 2.401.1.1687268694-1.el8
openvswitch3.1 (Red Hat package) - update to 3.1.0-32.el9fdp
kata-containers (Red Hat package) - update to 3.1.3-4.rhaos4.14.el9
podman (Red Hat package) - addressed in versions 3.2.3-1.1.rhaos4.10.el8, 4.0.2-7.rhaos4.11.el8, 4.4.1-10.1.rhaos4.14.el8, 4.4.1-10.1.rhaos4.14.el9
catch (Red Hat package) - update to 3.3.2-1.el9
openshift-kuryr (Red Hat package) - addressed in versions 4.10.0-202306170106.p0.g8e4df8b.assembly.stream.el8, 4.11.0-202306280915.p0.gc732699.assembly.stream.el8, 4.12.0-202306230041.p0.g31dd228.assembly.stream.el8, 4.13.0-202306281017.p0.g5baee73.assembly.stream.el8, 4.14.0-202309272140.p0.g8926a29.assembly.stream.el8
openshift (Red Hat package) - addressed in versions 4.10.0-202306170106.p0.g16bcd69.assembly.stream.el7, 4.10.0-202306170106.p0.g16bcd69.assembly.stream.el8, 4.11.0-202306260054.p0.g990d55b.assembly.stream.el8, 4.12.0-202306251254.p0.gc43ddea.assembly.stream.el8, 4.12.0-202306251254.p0.gc43ddea.assembly.stream.el9, 4.13.0-202307132344.p0.gf245ced.assembly.stream.el8, 4.13.0-202307132344.p0.gf245ced.assembly.stream.el9, 4.14.0-202310210404.p0.gf67aeb3.assembly.stream.el8, 4.14.0-202310210404.p0.gf67aeb3.assembly.stream.el9
openshift-ansible (Red Hat package) - addressed in versions 4.10.0-202306170106.p0.g72c7be6.assembly.stream.el7, 4.10.0-202306170106.p0.g72c7be6.assembly.stream.el8, 4.11.0-202306230041.p0.g0a466d7.assembly.stream.el8, 4.12.0-202306230041.p0.g74dc7b3.assembly.stream.el8, 4.13.0-202306230038.p0.g148be47.assembly.stream.el8, 4.13.0-202306230038.p0.g148be47.assembly.stream.el9, 4.14.0-202310062327.p0.gf781421.assembly.stream.el8, 4.14.0-202310062327.p0.gf781421.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.10.0-202306261054.p0.g22cf04a.assembly.stream.el7, 4.10.0-202306261054.p0.g22cf04a.assembly.stream.el8, 4.11.0-202306231116.p0.g2ae2303.assembly.stream.el8, 4.12.0-202306230041.p0.gea7c11a.assembly.stream.el8, 4.12.0-202306230041.p0.gea7c11a.assembly.stream.el9, 4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8, 4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9, 4.14.0-202310191146.p0.g0c63f9d.assembly.stream.el8, 4.14.0-202310191146.p0.g0c63f9d.assembly.stream.el9
jenkins-2-plugins (Red Hat package) - update to 4.10.1687341544-1.el8
openshift4-aws-iso (Red Hat package) - addressed in versions 4.12.0-202306230041.p0.gd2acdd5.assembly.stream.el8, 4.13.0-202306230038.p0.gd2acdd5.assembly.stream.el8, 4.14.0-202309272140.p0.gd2acdd5.assembly.stream.el8
kernel (Red Hat package) - addressed in versions 4.18.0-305.95.1.el8_4, 5.14.0-284.23.1.el9_2, 5.14.0-284.36.1.el9_2
kernel-rt (Red Hat package) - addressed in versions 4.18.0-305.95.1.rt7.170.el8_4, 5.14.0-284.23.1.rt14.308.el9_2, 5.14.0-284.36.1.rt14.321.el9_2
rust-afterburn (Red Hat package) - update to 5.4.3-1.rhaos4.14.el9
fmt (Red Hat package) - update to 9.1.0-1.el9
openstack-ironic (Red Hat package) - update to 21.3.1-0.20230706125653.c8f8157.el9
ovn23.06 (Red Hat package) - addressed in versions 23.06.0-13.el8fdp, 23.06.0-13.el9fdp
ovn23.09 (Red Hat package) - update to 23.09.0-37.el9fdp

• https://access.redhat.com/security/cve/CVE-2023-3089
• https://bugzilla.redhat.com/show_bug.cgi?id=2212085

• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• MitM attack in OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat VolSync
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.2
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.3
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.4
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.11
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.10
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.12
• Multiple vulnerabilities in OpenShift sandboxed containers 1.4
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in Red Hat Gatekeeper Operator
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• MitM attack in Red Hat OpenShift Serverless Client
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat DevWorkspace Operator
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat VolSync 0.6
• Multiple vulnerabilities in Red Hat VolSync 0.5
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.2
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.7
• Multiple vulnerabilities in OpenShift Virtualization 4.13
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.3
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.8
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.1
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.6
• Multiple vulnerabilities in Red Hat OpenShift Virtualization release 4.11
• Multiple vulnerabilities in OpenShift Container Platform 4.14