Vulnerability-Lookup

RHSA-2023_4290

Vulnerability from csaf_redhat - Published: 2023-07-27 00:59 - Updated: 2024-12-01 15:11

Summary

Red Hat Security Advisory: OpenShift sandboxed containers 1.4.1 security update

Severity

Moderate

Notes

Topic: OpenShift sandboxed containers 1.4.1 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: OpenShift sandboxed containers support for OpenShift Container Platform provides users with built-in support for running Kata containers as an additional, optional runtime. This advisory contains a security update for OpenShift sandboxed containers, as well as bug fixes. Security fix: * A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated. (CVE-2023-3089) For more information about the additional fixes in this release, see the Release Notes documentation: https://access.redhat.com/documentation/en-us/openshift_sandboxed_containers/1.4/html-single/openshift_sandboxed_containers_release_notes/

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-3089

A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Vendor Fix Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2023:4290

Workaround Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.

References

URL

Category

	https://access.redhat.com/errata/RHSA-2023:4290	self
	https://access.redhat.com/security/vulnerabilitie…	external
	https://access.redhat.com/security/updates/classi…	external
	https://access.redhat.com/documentation/en-us/ope…	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2212085	external
	https://issues.redhat.com/browse/KATA-2121	external
	https://issues.redhat.com/browse/KATA-2212	external
	https://issues.redhat.com/browse/KATA-2299	external
	https://issues.redhat.com/browse/OCPBUGS-15175	external
	https://security.access.redhat.com/data/csaf/v2/a…	self
	https://access.redhat.com/security/cve/CVE-2023-3089	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2212085	external
	https://access.redhat.com/security/vulnerabilitie…	external
	https://www.cve.org/CVERecord?id=CVE-2023-3089	external
	https://nvd.nist.gov/vuln/detail/CVE-2023-3089	external

Acknowledgments

Red Hat David Benoit

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "OpenShift sandboxed containers 1.4.1 is now available.\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift sandboxed containers support for OpenShift Container Platform\nprovides users with built-in support for running Kata containers as an\nadditional, optional runtime.\n\nThis advisory contains a security update for OpenShift sandboxed containers, as well as bug fixes.\n\nSecurity fix:\n\n* A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated. (CVE-2023-3089)\n\nFor more information about the additional fixes in this release, see the Release Notes documentation:\n\nhttps://access.redhat.com/documentation/en-us/openshift_sandboxed_containers/1.4/html-single/openshift_sandboxed_containers_release_notes/",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:4290",
        "url": "https://access.redhat.com/errata/RHSA-2023:4290"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-001",
        "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-001"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/openshift_sandboxed_containers/1.4/html-single/openshift_sandboxed_containers_release_notes/",
        "url": "https://access.redhat.com/documentation/en-us/openshift_sandboxed_containers/1.4/html-single/openshift_sandboxed_containers_release_notes/"
      },
      {
        "category": "external",
        "summary": "2212085",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2212085"
      },
      {
        "category": "external",
        "summary": "KATA-2121",
        "url": "https://issues.redhat.com/browse/KATA-2121"
      },
      {
        "category": "external",
        "summary": "KATA-2212",
        "url": "https://issues.redhat.com/browse/KATA-2212"
      },
      {
        "category": "external",
        "summary": "KATA-2299",
        "url": "https://issues.redhat.com/browse/KATA-2299"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-15175",
        "url": "https://issues.redhat.com/browse/OCPBUGS-15175"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4290.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift sandboxed containers 1.4.1 security update",
    "tracking": {
      "current_release_date": "2024-12-01T15:11:31+00:00",
      "generator": {
        "date": "2024-12-01T15:11:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2023:4290",
      "initial_release_date": "2023-07-27T00:59:29+00:00",
      "revision_history": [
        {
          "date": "2023-07-27T00:59:29+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-07-27T00:59:29+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-01T15:11:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Sandboxed Containers 1.4",
                "product": {
                  "name": "OpenShift Sandboxed Containers 1.4",
                  "product_id": "9Base-OSE-OSC-1.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_sandboxed_containers:1.4.0::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:dddb09a228b578d122dc7e2418b0f7e7012706ec98e6660753b926a305a1d99d_amd64",
                "product": {
                  "name": "openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:dddb09a228b578d122dc7e2418b0f7e7012706ec98e6660753b926a305a1d99d_amd64",
                  "product_id": "openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:dddb09a228b578d122dc7e2418b0f7e7012706ec98e6660753b926a305a1d99d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/osc-cloud-api-adaptor-rhel9@sha256:dddb09a228b578d122dc7e2418b0f7e7012706ec98e6660753b926a305a1d99d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9\u0026tag=1.4.1-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:128fec3b462e781635876b4e43dec3dc2ef787e6128ad245ed78f2196a4a798e_amd64",
                "product": {
                  "name": "openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:128fec3b462e781635876b4e43dec3dc2ef787e6128ad245ed78f2196a4a798e_amd64",
                  "product_id": "openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:128fec3b462e781635876b4e43dec3dc2ef787e6128ad245ed78f2196a4a798e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/osc-cloud-api-adaptor-webhook-rhel9@sha256:128fec3b462e781635876b4e43dec3dc2ef787e6128ad245ed78f2196a4a798e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9\u0026tag=1.4.1-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-sandboxed-containers/osc-monitor-rhel9@sha256:77fb428dfbf4d2dfa993cae7b005d69d5b35feaa585ffd25d34062998403462e_amd64",
                "product": {
                  "name": "openshift-sandboxed-containers/osc-monitor-rhel9@sha256:77fb428dfbf4d2dfa993cae7b005d69d5b35feaa585ffd25d34062998403462e_amd64",
                  "product_id": "openshift-sandboxed-containers/osc-monitor-rhel9@sha256:77fb428dfbf4d2dfa993cae7b005d69d5b35feaa585ffd25d34062998403462e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/osc-monitor-rhel9@sha256:77fb428dfbf4d2dfa993cae7b005d69d5b35feaa585ffd25d34062998403462e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel9\u0026tag=1.4.1-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:66fd690e92a853bfd9a4d03a64e0b7b75ef142c3c9f570b404fb93c0e58385b7_amd64",
                "product": {
                  "name": "openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:66fd690e92a853bfd9a4d03a64e0b7b75ef142c3c9f570b404fb93c0e58385b7_amd64",
                  "product_id": "openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:66fd690e92a853bfd9a4d03a64e0b7b75ef142c3c9f570b404fb93c0e58385b7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/osc-must-gather-rhel9@sha256:66fd690e92a853bfd9a4d03a64e0b7b75ef142c3c9f570b404fb93c0e58385b7?arch=amd64\u0026repository_url=registry.redhat.io/openshift-sandboxed-containers/osc-must-gather-rhel9\u0026tag=1.4.1-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-sandboxed-containers/osc-operator-bundle@sha256:7a28671f1fe44e66ef519c8540d709969c7b3ff291e0c8ea8547588cf0e1bd6e_amd64",
                "product": {
                  "name": "openshift-sandboxed-containers/osc-operator-bundle@sha256:7a28671f1fe44e66ef519c8540d709969c7b3ff291e0c8ea8547588cf0e1bd6e_amd64",
                  "product_id": "openshift-sandboxed-containers/osc-operator-bundle@sha256:7a28671f1fe44e66ef519c8540d709969c7b3ff291e0c8ea8547588cf0e1bd6e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/osc-operator-bundle@sha256:7a28671f1fe44e66ef519c8540d709969c7b3ff291e0c8ea8547588cf0e1bd6e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-sandboxed-containers/osc-operator-bundle\u0026tag=1.4.1-9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-sandboxed-containers/osc-rhel9-operator@sha256:65337250abfb5347dcf5b8bf8e1113ffbda214da990c958bcb2d7bb69c99fb53_amd64",
                "product": {
                  "name": "openshift-sandboxed-containers/osc-rhel9-operator@sha256:65337250abfb5347dcf5b8bf8e1113ffbda214da990c958bcb2d7bb69c99fb53_amd64",
                  "product_id": "openshift-sandboxed-containers/osc-rhel9-operator@sha256:65337250abfb5347dcf5b8bf8e1113ffbda214da990c958bcb2d7bb69c99fb53_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/osc-rhel9-operator@sha256:65337250abfb5347dcf5b8bf8e1113ffbda214da990c958bcb2d7bb69c99fb53?arch=amd64\u0026repository_url=registry.redhat.io/openshift-sandboxed-containers/osc-rhel9-operator\u0026tag=1.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:365893d3bc80f43bdebfb2f34898a8531a80aa63d9c43bdb6dd33eb2ac6505bd_amd64",
                "product": {
                  "name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:365893d3bc80f43bdebfb2f34898a8531a80aa63d9c43bdb6dd33eb2ac6505bd_amd64",
                  "product_id": "openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:365893d3bc80f43bdebfb2f34898a8531a80aa63d9c43bdb6dd33eb2ac6505bd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/osc-podvm-payload-rhel9@sha256:365893d3bc80f43bdebfb2f34898a8531a80aa63d9c43bdb6dd33eb2ac6505bd?arch=amd64\u0026repository_url=registry.redhat.io/openshift-sandboxed-containers/osc-podvm-payload-rhel9\u0026tag=1.4.1-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:dddb09a228b578d122dc7e2418b0f7e7012706ec98e6660753b926a305a1d99d_amd64 as a component of OpenShift Sandboxed Containers 1.4",
          "product_id": "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:dddb09a228b578d122dc7e2418b0f7e7012706ec98e6660753b926a305a1d99d_amd64"
        },
        "product_reference": "openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:dddb09a228b578d122dc7e2418b0f7e7012706ec98e6660753b926a305a1d99d_amd64",
        "relates_to_product_reference": "9Base-OSE-OSC-1.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:128fec3b462e781635876b4e43dec3dc2ef787e6128ad245ed78f2196a4a798e_amd64 as a component of OpenShift Sandboxed Containers 1.4",
          "product_id": "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:128fec3b462e781635876b4e43dec3dc2ef787e6128ad245ed78f2196a4a798e_amd64"
        },
        "product_reference": "openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:128fec3b462e781635876b4e43dec3dc2ef787e6128ad245ed78f2196a4a798e_amd64",
        "relates_to_product_reference": "9Base-OSE-OSC-1.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-sandboxed-containers/osc-monitor-rhel9@sha256:77fb428dfbf4d2dfa993cae7b005d69d5b35feaa585ffd25d34062998403462e_amd64 as a component of OpenShift Sandboxed Containers 1.4",
          "product_id": "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-monitor-rhel9@sha256:77fb428dfbf4d2dfa993cae7b005d69d5b35feaa585ffd25d34062998403462e_amd64"
        },
        "product_reference": "openshift-sandboxed-containers/osc-monitor-rhel9@sha256:77fb428dfbf4d2dfa993cae7b005d69d5b35feaa585ffd25d34062998403462e_amd64",
        "relates_to_product_reference": "9Base-OSE-OSC-1.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:66fd690e92a853bfd9a4d03a64e0b7b75ef142c3c9f570b404fb93c0e58385b7_amd64 as a component of OpenShift Sandboxed Containers 1.4",
          "product_id": "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:66fd690e92a853bfd9a4d03a64e0b7b75ef142c3c9f570b404fb93c0e58385b7_amd64"
        },
        "product_reference": "openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:66fd690e92a853bfd9a4d03a64e0b7b75ef142c3c9f570b404fb93c0e58385b7_amd64",
        "relates_to_product_reference": "9Base-OSE-OSC-1.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-sandboxed-containers/osc-operator-bundle@sha256:7a28671f1fe44e66ef519c8540d709969c7b3ff291e0c8ea8547588cf0e1bd6e_amd64 as a component of OpenShift Sandboxed Containers 1.4",
          "product_id": "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-operator-bundle@sha256:7a28671f1fe44e66ef519c8540d709969c7b3ff291e0c8ea8547588cf0e1bd6e_amd64"
        },
        "product_reference": "openshift-sandboxed-containers/osc-operator-bundle@sha256:7a28671f1fe44e66ef519c8540d709969c7b3ff291e0c8ea8547588cf0e1bd6e_amd64",
        "relates_to_product_reference": "9Base-OSE-OSC-1.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:365893d3bc80f43bdebfb2f34898a8531a80aa63d9c43bdb6dd33eb2ac6505bd_amd64 as a component of OpenShift Sandboxed Containers 1.4",
          "product_id": "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:365893d3bc80f43bdebfb2f34898a8531a80aa63d9c43bdb6dd33eb2ac6505bd_amd64"
        },
        "product_reference": "openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:365893d3bc80f43bdebfb2f34898a8531a80aa63d9c43bdb6dd33eb2ac6505bd_amd64",
        "relates_to_product_reference": "9Base-OSE-OSC-1.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-sandboxed-containers/osc-rhel9-operator@sha256:65337250abfb5347dcf5b8bf8e1113ffbda214da990c958bcb2d7bb69c99fb53_amd64 as a component of OpenShift Sandboxed Containers 1.4",
          "product_id": "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-rhel9-operator@sha256:65337250abfb5347dcf5b8bf8e1113ffbda214da990c958bcb2d7bb69c99fb53_amd64"
        },
        "product_reference": "openshift-sandboxed-containers/osc-rhel9-operator@sha256:65337250abfb5347dcf5b8bf8e1113ffbda214da990c958bcb2d7bb69c99fb53_amd64",
        "relates_to_product_reference": "9Base-OSE-OSC-1.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2023-3089",
      "cwe": {
        "id": "CWE-327",
        "name": "Use of a Broken or Risky Cryptographic Algorithm"
      },
      "discovery_date": "2023-06-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2212085"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openshift: OCP \u0026 FIPS mode",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-001\n\nThe static scanning tool (to verify your system is once again compliant with FIPS) is available here https://github.com/openshift/check-payload",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:dddb09a228b578d122dc7e2418b0f7e7012706ec98e6660753b926a305a1d99d_amd64",
          "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:128fec3b462e781635876b4e43dec3dc2ef787e6128ad245ed78f2196a4a798e_amd64",
          "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-monitor-rhel9@sha256:77fb428dfbf4d2dfa993cae7b005d69d5b35feaa585ffd25d34062998403462e_amd64",
          "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:66fd690e92a853bfd9a4d03a64e0b7b75ef142c3c9f570b404fb93c0e58385b7_amd64",
          "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-operator-bundle@sha256:7a28671f1fe44e66ef519c8540d709969c7b3ff291e0c8ea8547588cf0e1bd6e_amd64",
          "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:365893d3bc80f43bdebfb2f34898a8531a80aa63d9c43bdb6dd33eb2ac6505bd_amd64",
          "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-rhel9-operator@sha256:65337250abfb5347dcf5b8bf8e1113ffbda214da990c958bcb2d7bb69c99fb53_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-3089"
        },
        {
          "category": "external",
          "summary": "RHBZ#2212085",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2212085"
        },
        {
          "category": "external",
          "summary": "RHSB-2023-001",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-001"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-3089",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-3089"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-3089",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3089"
        }
      ],
      "release_date": "2023-07-05T12:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-07-27T00:59:29+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:dddb09a228b578d122dc7e2418b0f7e7012706ec98e6660753b926a305a1d99d_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:128fec3b462e781635876b4e43dec3dc2ef787e6128ad245ed78f2196a4a798e_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-monitor-rhel9@sha256:77fb428dfbf4d2dfa993cae7b005d69d5b35feaa585ffd25d34062998403462e_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:66fd690e92a853bfd9a4d03a64e0b7b75ef142c3c9f570b404fb93c0e58385b7_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-operator-bundle@sha256:7a28671f1fe44e66ef519c8540d709969c7b3ff291e0c8ea8547588cf0e1bd6e_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:365893d3bc80f43bdebfb2f34898a8531a80aa63d9c43bdb6dd33eb2ac6505bd_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-rhel9-operator@sha256:65337250abfb5347dcf5b8bf8e1113ffbda214da990c958bcb2d7bb69c99fb53_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:4290"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.",
          "product_ids": [
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:dddb09a228b578d122dc7e2418b0f7e7012706ec98e6660753b926a305a1d99d_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:128fec3b462e781635876b4e43dec3dc2ef787e6128ad245ed78f2196a4a798e_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-monitor-rhel9@sha256:77fb428dfbf4d2dfa993cae7b005d69d5b35feaa585ffd25d34062998403462e_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:66fd690e92a853bfd9a4d03a64e0b7b75ef142c3c9f570b404fb93c0e58385b7_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-operator-bundle@sha256:7a28671f1fe44e66ef519c8540d709969c7b3ff291e0c8ea8547588cf0e1bd6e_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:365893d3bc80f43bdebfb2f34898a8531a80aa63d9c43bdb6dd33eb2ac6505bd_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-rhel9-operator@sha256:65337250abfb5347dcf5b8bf8e1113ffbda214da990c958bcb2d7bb69c99fb53_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:dddb09a228b578d122dc7e2418b0f7e7012706ec98e6660753b926a305a1d99d_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:128fec3b462e781635876b4e43dec3dc2ef787e6128ad245ed78f2196a4a798e_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-monitor-rhel9@sha256:77fb428dfbf4d2dfa993cae7b005d69d5b35feaa585ffd25d34062998403462e_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:66fd690e92a853bfd9a4d03a64e0b7b75ef142c3c9f570b404fb93c0e58385b7_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-operator-bundle@sha256:7a28671f1fe44e66ef519c8540d709969c7b3ff291e0c8ea8547588cf0e1bd6e_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:365893d3bc80f43bdebfb2f34898a8531a80aa63d9c43bdb6dd33eb2ac6505bd_amd64",
            "9Base-OSE-OSC-1.4:openshift-sandboxed-containers/osc-rhel9-operator@sha256:65337250abfb5347dcf5b8bf8e1113ffbda214da990c958bcb2d7bb69c99fb53_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openshift: OCP \u0026 FIPS mode"
    }
  ]
}

CVE-2023-3089 (GCVE-0-2023-3089)

Vulnerability from cvelistv5 – Published: 2023-07-05 12:21 – Updated: 2024-10-24 19:13

Title

Ocp & fips mode

Summary

A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

Severity ?

7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

CWE

CWE-693 - Protection Mechanism Failure

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/security/cve/CVE-2023-3089	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2212085	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

n/a

openshift

Unaffected: 4.12.0

Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	OpenShift Service Mesh 2.2.x	cpe:/a:redhat:service_mesh:2.2
Red Hat	OpenShift Service Mesh 2.3.x	cpe:/a:redhat:service_mesh:2.3
Red Hat	OpenShift Service Mesh 2.4	cpe:/a:redhat:service_mesh:2.4
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat JBoss A-MQ Streams	cpe:/a:redhat:amq_streams:1
Red Hat	Red Hat OpenShift Container Platform 3.11	cpe:/a:redhat:openshift:3.11
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4
Red Hat	Red Hat Openshift sandboxed containers	cpe:/a:redhat:openshift_sandboxed_containers:1
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4

Date Public ?

2023-07-05 12:00

Credits

This issue was discovered by David Benoit (Red Hat).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:41:04.166Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2023-3089"
          },
          {
            "name": "RHBZ#2212085",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2212085"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3089",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-24T19:12:21.482201Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-24T19:13:59.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openshift",
          "vendor": "n/a",
          "versions": [
            {
              "status": "unaffected",
              "version": "4.12.0"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "(as-yet-unknown)",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:service_mesh:2.2"
          ],
          "defaultStatus": "affected",
          "packageName": "(as-yet-unknown)",
          "product": "OpenShift Service Mesh 2.2.x",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:service_mesh:2.3"
          ],
          "defaultStatus": "affected",
          "packageName": "(as-yet-unknown)",
          "product": "OpenShift Service Mesh 2.3.x",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:service_mesh:2.4"
          ],
          "defaultStatus": "affected",
          "packageName": "(as-yet-unknown)",
          "product": "OpenShift Service Mesh 2.4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:acm:2"
          ],
          "defaultStatus": "affected",
          "packageName": "(as-yet-unknown)",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:amq_streams:1"
          ],
          "defaultStatus": "affected",
          "packageName": "(as-yet-unknown)",
          "product": "Red Hat JBoss A-MQ Streams",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:3.11"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift",
          "product": "Red Hat OpenShift Container Platform 3.11",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-ansible",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-golang-builder-container",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_data_foundation:4"
          ],
          "defaultStatus": "affected",
          "packageName": "(as-yet-unknown)",
          "product": "Red Hat Openshift Data Foundation 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_sandboxed_containers:1"
          ],
          "defaultStatus": "affected",
          "packageName": "(as-yet-unknown)",
          "product": "Red Hat Openshift sandboxed containers",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "(as-yet-unknown)",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by David Benoit (Red Hat)."
        }
      ],
      "datePublic": "2023-07-05T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-05T12:21:03.036Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2023-3089"
        },
        {
          "name": "RHBZ#2212085",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2212085"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-03T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2023-07-05T12:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Ocp \u0026 fips mode",
      "workarounds": [
        {
          "lang": "en",
          "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible."
        }
      ],
      "x_redhatCweChain": "CWE-166-\u003eCWE-693: Improper Handling of Missing Special Element leads to Protection Mechanism Failure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-3089",
    "datePublished": "2023-07-05T12:21:03.036Z",
    "dateReserved": "2023-06-03T17:29:23.874Z",
    "dateUpdated": "2024-10-24T19:13:59.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2023_4290

CVE-2023-3089 (GCVE-0-2023-3089)

Tags

Sightings

Nomenclature