Skip to content
Fencer Vulns
high 7.0

CVE-2023-3089 json

Ocp & fips mode

published 2023-07-05 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-43777

cvss
7.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

Patch / fix

  • fmt openshift 4.14 9.1.0-1.el9
  • crun openshift 4.14 1.9.2-1.rhaos4.14.el8
  • crun openshift 4.14 1.9.2-1.rhaos4.14.el9
  • perf openshift 4.14 5.14.0-284.36.1.el9_2
  • rtla openshift 4.14 5.14.0-284.36.1.el9_2
  • runc openshift 4.14 4:1.1.9-2.1.rhaos4.14.el8
  • runc openshift 4.14 4:1.1.9-2.1.rhaos4.14.el9
  • catch openshift 4.14 3.3.2-1.el9

red hat advisories RHSA-2023:5009RHSA-2023:4093RHSA-2023:3914RHSA-2023:3910RHSA-2023:3924RHSA-2023:4471

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-3089 updated cvss 6.5

openshift: OCP & FIPS mode

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/volsync-rhel8
    affected: workaround, no fix available “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.”
  • Red Hat CNV 4.11 for RHEL 8 container-native-virtualization/hyperconverged-cluster-operator v4.11.6-4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:5103
  • Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/virt-api v4.12.5-11, container-native-virtualization/virtio-win v4.12.5-3, container-native-virtualization/kubemacpool v4.12.5-7, container-native-virtualization/bridge-marker v4.12.5-7, container-native-virtualization/virt-handler v4.12.5-11, container-native-virtualization/ovs-cni-marker v4.12.5-7, +37 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4421
  • Red Hat CNV 4.13 for RHEL 9 container-native-virtualization/hyperconverged-cluster-operator-rhel9 v4.13.3--2023-117063
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4664
  • Red Hat Devworkspace 1.0 for RHEL 8 devworkspace/devworkspace-rhel8-operator 0.21-5, devworkspace/devworkspace-operator-bundle 0.21-7, devworkspace/devworkspace-project-clone-rhel8 0.21-5
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4276
  • Red Hat OpenShift Sandboxed Containers 1.4 openshift-sandboxed-containers/osc-monitor-rhel9 1.4.1-2, openshift-sandboxed-containers/osc-rhel9-operator 1.4.1-4, openshift-sandboxed-containers/osc-operator-bundle 1.4.1-9, openshift-sandboxed-containers/osc-must-gather-rhel9 1.4.1-6, openshift-sandboxed-containers/osc-podvm-payload-rhel9 1.4.1-2, openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9 1.4.1-5, +1 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4290
  • Red Hat OpenShift Container Platform 4.10 openshift 4.10.0-202306170106.p0.g16bcd69.assembly.stream.el7, openshift 4.10.0-202306170106.p0.g16bcd69.assembly.stream.el8, openshift4/ose-cli v4.10.0-202306261054.p0.g22cf04a.assembly.stream, openshift4/ose-pod v4.10.0-202306170106.p0.g16bcd69.assembly.stream, openshift4/ose-ptp v4.10.0-202306170106.p0.g7746635.assembly.stream, openshift4/ose-etcd v4.10.0-202306170106.p0.gc3be56f.assembly.stream, +199 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:3910
  • Red Hat OpenShift Container Platform 4.11 openshift 4.11.0-202306260054.p0.g990d55b.assembly.stream.el8, openshift4/ose-cli v4.11.0-202306270118.p0.g2ae2303.assembly.stream, openshift4/ose-pod v4.11.0-202306270118.p0.g990d55b.assembly.stream, openshift4/ose-ptp v4.11.0-202306270118.p0.gee62031.assembly.stream, openshift4/ose-etcd v4.11.0-202306270118.p0.gc637f9b.assembly.stream, openshift-ansible 4.11.0-202306230041.p0.g0a466d7.assembly.stream.el8, +208 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:3914
show 14 more
  • Red Hat OpenShift Container Platform 4.12 openshift 4.12.0-202306251254.p0.gc43ddea.assembly.stream.el8, openshift 4.12.0-202306251254.p0.gc43ddea.assembly.stream.el9, openshift4/ose-cli v4.12.0-202306261055.p0.gea7c11a.assembly.stream, openshift4/ose-pod v4.12.0-202306261055.p0.gc43ddea.assembly.stream, openshift4/ose-ptp v4.12.0-202306281416.p0.gcad743b.assembly.stream, openshift4/ose-etcd v4.12.0-202306261055.p0.gc1d76ff.assembly.stream, +221 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:3924
  • Red Hat OpenShift Container Platform 4.13 openshift 4.13.0-202307132344.p0.gf245ced.assembly.stream.el8, openshift 4.13.0-202307132344.p0.gf245ced.assembly.stream.el9, openshift4/ose-cli v4.13.0-202307282024.p0.ge251b5e.assembly.stream, openshift4/ose-pod v4.13.0-202307242035.p0.g73ac561.assembly.stream, openshift4/ose-etcd v4.13.0-202307261038.p0.g1b61faa.assembly.stream, openshift4/ose-tests v4.13.0-202308011445.p0.gb1f4ee9.assembly.stream, +179 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4093
  • Red Hat OpenShift Container Platform 4.14 openshift 4.14.0-202310210404.p0.gf67aeb3.assembly.stream.el8, openshift 4.14.0-202310210404.p0.gf67aeb3.assembly.stream.el9, openshift4/ose-cli v4.14.0-202310201027.p0.g0c63f9d.assembly.stream, openshift4/ose-pod v4.14.0-202310210404.p0.gf67aeb3.assembly.stream, openshift4/ose-tests v4.14.0-202310201027.p0.g948001a.assembly.stream, openshift-hyperkube 4.14.0-202310210404.p0.gf67aeb3.assembly.stream.el8, +184 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:5009
  • Red Hat OpenShift Dev Spaces 3 devspaces/udi-rhel8 3.7-18, devspaces/idea-rhel8 3.7-11, devspaces/code-rhel8 3.7-100, devspaces/server-rhel8 3.7-26, devspaces/traefik-rhel8 3.7-9, devspaces/dashboard-rhel8 3.7-47, +7 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4286
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.8.1-6.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4471
  • Red Hat OpenShift Serverless 1.29 openshift-serverless-1/client-kn-rhel8 1.8.1-4, openshift-serverless-1/func-utils-rhel8 1.29.1-1, openshift-serverless-1/serving-queue-rhel8 1.8.0-4, openshift-serverless-1/eventing-mtping-rhel8 1.8.0-4, openshift-serverless-1/kourier-control-rhel8 1.8.0-5, openshift-serverless-1/serving-webhook-rhel8 1.8.0-4, +30 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4472
  • Red Hat RHODF 4.10 for RHEL 8 odf4/cephcsi-rhel8 v4.10.14-1, odf4/mcg-core-rhel8 v4.10.14-1, odf4/odf-console-rhel8 v4.10.14-1, odf4/odf-topolvm-rhel8 v4.10.14-1, odf4/mcg-rhel8-operator v4.10.14-1, odf4/ocs-rhel8-operator v4.10.14-1, +18 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4241
  • Red Hat RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8 v4.11.9-1, odf4/mcg-core-rhel8 v4.11.9-1, odf4/odf-console-rhel8 v4.11.9-1, odf4/odf-topolvm-rhel8 v4.11.9-1, odf4/mcg-rhel8-operator v4.11.9-1, odf4/ocs-rhel8-operator v4.11.9-1, +20 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4238
  • Red Hat RHODF 4.12 for RHEL 8 odf4/cephcsi-rhel8 v4.12.5-1, odf4/mcg-core-rhel8 v4.12.5-1, odf4/odf-console-rhel8 v4.12.5-1, odf4/mcg-rhel8-operator v4.12.5-1, odf4/ocs-rhel8-operator v4.12.5-1, odf4/odf-rhel8-operator v4.12.5-1, +17 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4287
  • Red Hat RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9 v4.13.1-7, odf4/mcg-cli-rhel9 v4.13.1-4, odf4/mcg-core-rhel9 v4.13.1-6, odf4/odf-console-rhel9 v4.13.1-3, odf4/mcg-rhel9-operator v4.13.1-4, odf4/ocs-rhel9-operator v4.13.1-4, +18 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4437
  • Red Hat RHOSSM 2.2 for RHEL 8 openshift-service-mesh/pilot-rhel8 2.2.8-4, openshift-service-mesh/kiali-rhel8 1.48.7-2, openshift-service-mesh/grafana-rhel8 2.2.8-2, openshift-service-mesh/proxyv2-rhel8 2.2.8-3, openshift-service-mesh/istio-cni-rhel8 2.2.8-4, openshift-service-mesh/ratelimit-rhel8 2.2.8-3, +2 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4112
  • Red Hat RHOSSM 2.3 for RHEL 8 openshift-service-mesh/pilot-rhel8 2.3.5-3, openshift-service-mesh/grafana-rhel8 2.3.5-2, openshift-service-mesh/kiali-rhel8 1.57.10-3, openshift-service-mesh/proxyv2-rhel8 2.3.5-2, openshift-service-mesh/istio-cni-rhel8 2.3.5-3, openshift-service-mesh/ratelimit-rhel8 2.3.5-3, +2 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4113
  • Red Hat RHOSSM 2.4 for RHEL 8 openshift-service-mesh/pilot-rhel8 2.4.1-3, openshift-service-mesh/kiali-rhel8 1.65.7-5, openshift-service-mesh/grafana-rhel8 2.4.1-2, openshift-service-mesh/proxyv2-rhel8 2.4.1-3, openshift-service-mesh/istio-cni-rhel8 2.4.1-3, openshift-service-mesh/ratelimit-rhel8 2.4.1-3, +3 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.” RHSA-2023:4114
  • Red Hat CNV 4.11 for RHEL 8 container-native-virtualization/virt-api v4.11.6-4, container-native-virtualization/virtio-win v4.11.6-3, container-native-virtualization/kubemacpool v4.11.6-3, container-native-virtualization/virt-handler v4.11.6-4, container-native-virtualization/bridge-marker v4.11.6-3, container-native-virtualization/virt-launcher v4.11.6-4, +36 more Red Hat CNV 4.13 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.13.3--2023-117063, container-native-virtualization/virtio-win-rhel9 v4.13.3--2023-117063, container-native-virtualization/kubemacpool-rhel9 v4.13.3--2023-117063, container-native-virtualization/multus-dynamic-networks-rhel9 v4.13.3-9, container-native-virtualization/virt-handler-rhel9 v4.13.3--2023-117063, container-native-virtualization/bridge-marker-rhel9 v4.13.3--2023-117063, +39 more Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 openstack-ironic 21.3.1-0.20230706125653.c8f8157.el9, openstack-ironic-api 21.3.1-0.20230706125653.c8f8157.el9, python3-ironic-tests 21.3.1-0.20230706125653.c8f8157.el9, openstack-ironic-common 21.3.1-0.20230706125653.c8f8157.el9, openstack-ironic-conductor 21.3.1-0.20230706125653.c8f8157.el9, openstack-ironic-dnsmasq-tftp-server 21.3.1-0.20230706125653.c8f8157.el9 Red Hat Ironic content for Red Hat OpenShift Container Platform 4.14 python-pbr 5.11.1-0.1.el9, python-wrapt 1.14.1-1.el9, python3-pbr 5.11.1-0.1.el9, python3-wrapt 1.14.1-1.el9, python-fixtures 4.0.1-1.el9, python-tenacity 6.3.1-1.el9, +135 more Red Hat OpenShift Container Platform 3.11 openshift Red Hat OpenShift Container Platform 4.10 skopeo 1.2.4-1.1.el8, buildah 1.19.9-1.1.el8, perf 4.18.0-305.95.1.el8_4, skopeo-tests 1.2.4-1.1.el8, buildah-tests 1.19.9-1.1.el8, kernel 4.18.0-305.95.1.el8_4, +79 more
    +4 more products
    Red Hat OpenShift Container Platform 4.11 runc 1.1.2-2.rhaos4.11.el8, conmon 2.1.2-3.rhaos4.11.el8, podman 4.0.2-7.rhaos4.11.el8, skopeo 1.5.2-4.rhaos4.11.el8, buildah 1.23.4-3.rhaos4.11.el8, podman-tests 4.0.2-7.rhaos4.11.el8, +33 more Red Hat OpenShift Container Platform 4.12 ovn23.06 23.06.0-13.el8fdp, ovn23.06-host 23.06.0-13.el8fdp, ovn23.06-vtep 23.06.0-13.el8fdp, ovn23.06-central 23.06.0-13.el8fdp, container-selinux 2.215.0-1.rhaos4.12.el8, openshift-kuryr 4.12.0-202306230041.p0.g31dd228.assembly.stream.el8, +27 more Red Hat OpenShift Container Platform 4.13 ovn23.06 23.06.0-13.el9fdp, perf 5.14.0-284.23.1.el9_2, rtla 5.14.0-284.23.1.el9_2, bpftool 7.0.0-284.23.1.el9_2, kernel 5.14.0-284.23.1.el9_2, nmstate 2.2.12-1.rhaos4.13.el8, +103 more Red Hat OpenShift Container Platform 4.14 fmt 9.1.0-1.el9, catch 3.3.2-1.el9, gmock 1.13.0-1.el9, gtest 1.13.0-1.el9, cri-tools 1.27.0-2.1.el8, cri-tools 1.27.0-2.1.el9, +152 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • n/a openshift
  • Red Hat OpenShift Serverless
  • Red Hat OpenShift Service Mesh 2.2.x
  • Red Hat OpenShift Service Mesh 2.3.x
  • Red Hat OpenShift Service Mesh 2.4
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat JBoss A-MQ Streams
  • Red Hat Red Hat OpenShift Container Platform 3.11
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat Openshift Data Foundation 4
  • Red Hat Red Hat Openshift sandboxed containers
  • Red Hat Red Hat OpenShift Virtualization 4

Classification

Weakness
  • CWE-693 Protection Mechanism Failure
  • CWE-521 Weak Password Requirements

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.