{"id":"CVE-2023-3089","state":"PUBLISHED","title":"Ocp & fips mode","description":"A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.","publishedAt":"2023-07-05T12:21:03.036Z","updatedAt":"2024-10-24T19:13:59.907Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","source":"redhat"},"assigner":"redhat","products":["n/a openshift","Red Hat OpenShift Serverless","Red Hat OpenShift Service Mesh 2.2.x","Red Hat OpenShift Service Mesh 2.3.x","Red Hat OpenShift Service Mesh 2.4","Red Hat Red Hat Advanced Cluster Management for Kubernetes 2","Red Hat Red Hat JBoss A-MQ Streams","Red Hat Red Hat OpenShift Container Platform 3.11","Red Hat Red Hat OpenShift Container Platform 4","Red Hat Red Hat Openshift Data Foundation 4","Red Hat Red Hat Openshift sandboxed containers","Red Hat Red Hat OpenShift Virtualization 4"],"affected":[{"vendor":"n/a","product":"openshift","versions":[{"version":"4.12.0","status":"unaffected"}]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Service Mesh 2.2.x","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:2.2"]},{"vendor":"Red Hat","product":"OpenShift Service Mesh 2.3.x","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:2.3"]},{"vendor":"Red Hat","product":"OpenShift Service Mesh 2.4","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:2.4"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"]},{"vendor":"Red Hat","product":"Red Hat JBoss A-MQ Streams","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:amq_streams:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 3.11","packageName":"openshift","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:3.11"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift-ansible","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift-golang-builder-container","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift sandboxed containers","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_sandboxed_containers:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Virtualization 4","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:container_native_virtualization:4"]}],"references":["https://access.redhat.com/security/cve/CVE-2023-3089","https://bugzilla.redhat.com/show_bug.cgi?id=2212085"],"weaknesses":["CWE-693"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/3xxx/CVE-2023-3089.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-3089","state":"PUBLISHED","datePublished":"2023-07-05T12:21:03.036Z","dateUpdated":"2024-10-24T19:13:59.907Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-06-03T17:29:23.874Z"},"containers":{"cna":{"title":"Ocp & fips mode","descriptions":[{"lang":"en","value":"A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated."}],"affected":[{"vendor":"n/a","product":"openshift","versions":[{"version":"4.12.0","status":"unaffected"}]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Service Mesh 2.2.x","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:2.2"]},{"vendor":"Red Hat","product":"OpenShift Service Mesh 2.3.x","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:2.3"]},{"vendor":"Red Hat","product":"OpenShift Service Mesh 2.4","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:2.4"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"]},{"vendor":"Red Hat","product":"Red Hat JBoss A-MQ Streams","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:amq_streams:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 3.11","packageName":"openshift","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:3.11"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift-ansible","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift-golang-builder-container","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift sandboxed containers","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_sandboxed_containers:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Virtualization 4","packageName":"(as-yet-unknown)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:container_native_virtualization:4"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-3089","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212085","name":"RHBZ#2212085","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-693","description":"Protection Mechanism Failure","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2023-07-05T12:21:03.036Z"},"datePublic":"2023-07-05T12:00:00.000Z","x_redhatCweChain":"CWE-166->CWE-693: Improper Handling of Missing Special Element leads to Protection Mechanism Failure","workarounds":[{"lang":"en","value":"Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible."}],"timeline":[{"lang":"en","time":"2023-06-03T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-07-05T12:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"This issue was discovered by David Benoit (Red Hat)."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-3089","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212085","name":"RHBZ#2212085","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T06:41:04.166Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-24T19:12:21.482201Z","id":"CVE-2023-3089","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-24T19:13:59.907Z"}}]}}}