Read the docs
TI-2023-02895 Aliases CVE-2023-3089GHSA-wj5p-x3cr-46w8

Ocp & fips mode

Priority LOW 33CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 20 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-693.

Summary

A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0052 44th percentileScored 2026-11-07
Fix Partial openshift: 4.12.0Red Hat: 28 advisoriesRed Hat: 20 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—openshift—4.12.0Patch availableCNA
Red HatOpenShift Serverless——No fix listedCNA
Red HatOpenShift Service Mesh 2.2.x——No fix listedCNA
Red HatOpenShift Service Mesh 2.3.x——No fix listedCNA
Red HatOpenShift Service Mesh 2.4——No fix listedCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2——No fix listedCNA
Red HatRed Hat JBoss A-MQ Streams——No fix listedCNA
Red HatRed Hat OpenShift Container Platform 3.11——Not affectedCNA
Red HatRed Hat OpenShift Container Platform 4——No fix listedCNA
Red HatRed Hat OpenShift Container Platform 4——No fix listedCNA
Red HatRed Hat OpenShift Container Platform 4——No fix listedCNA
Red HatRed Hat Openshift Data Foundation 4——No fix listedCNA
Red HatRed Hat Openshift sandboxed containers——No fix listedCNA
Red HatRed Hat OpenShift Virtualization 4——No fix listedCNA
  • openshift Vendor— Affected — Fixed in 4.12.0 Patch available CNA
  • OpenShift Serverless VendorRed Hat Affected — Fixed in — No fix listed CNA
  • OpenShift Service Mesh 2.2.x VendorRed Hat Affected — Fixed in — No fix listed CNA
  • OpenShift Service Mesh 2.3.x VendorRed Hat Affected — Fixed in — No fix listed CNA
  • OpenShift Service Mesh 2.4 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss A-MQ Streams VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenShift Container Platform 3.11 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Openshift Data Foundation 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Openshift sandboxed containers VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenShift Virtualization 4 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.11:*:*:*:*:*:*:*4.11VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.11:*:*:*:*:*:*:*4.11VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.11:*:*:*:*:*:*:*4.11VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.11:*:*:*:*:*:*:*4.11VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.12:*:*:*:*:*:*:*4.12VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.12:*:*:*:*:*:*:*4.12VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.12:*:*:*:*:*:*:*4.12VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.12:*:*:*:*:*:*:*4.12VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0Running onRed Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat

Remediation

  • Fix · CNA openshift Fixed in 4.12.0

Red Hat 28 advisories

  • RHSA-2023:5009 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 security update
    • Ironic content for Red Hat OpenShift Container Platform 4.14 openstack-ironic-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-api-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-common-1:21.5.0-0.20231002130534.0df5961.el9 +47
    • Red Hat OpenShift Container Platform 4.14 afterburn-5.4.3-1.rhaos4.14.el9, afterburn-dracut-5.4.3-1.rhaos4.14.el9, bpftool-7.0.0-284.36.1.el9_2 +47
  • RHSA-2023:5006 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2023:5103 Released 2023-09-12 · Red Hat rating Moderate
    OpenShift Virtualization 4.11.6 security and bug fix update
    • CNV 4.11 for RHEL 8 container-native-virtualization/hyperconverged-cluster-operator
Show 25 more Red Hat advisories
  • RHSA-2023:4980 Released 2023-09-05 · Red Hat rating Critical
    Red Hat Advanced Cluster Management 2.6.7 security and bug fix updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
  • RHSA-2023:4972 Released 2023-09-05 · Red Hat rating Critical
    Multicluster Engine for Kubernetes 2.1.8 security updates and bug fixes
    • multicluster engine for Kubernetes 2.1 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +37
  • RHSA-2023:4664 Released 2023-08-16 · Red Hat rating Important
    OpenShift Virtualization 4.13.3 Images security and bug fix update
    • CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
  • RHSA-2023:4575 Released 2023-08-08 · Red Hat rating Moderate
    VolSync 0.5.4 security fixes and enhancements
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/volsync-mover-rclone-rhel8, rhacm2/volsync-mover-restic-rhel8, rhacm2/volsync-mover-rsync-rhel8 +3
  • RHSA-2023:4456 Released 2023-08-08 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.8 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2023:4472 Released 2023-08-03 · Red Hat rating Moderate
    Release of OpenShift Serverless 1.29.1
    • Red Hat OpenShift Serverless 1.29 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8 +33
  • RHSA-2023:4471 Released 2023-08-03 · Red Hat rating Moderate
    Release of OpenShift Serverless Client kn 1.29.1
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.8.1-6.el8
  • RHSA-2023:4437 Released 2023-08-02 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.13.1 security and bug fix update
    • RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-cli-rhel9, odf4/mcg-core-rhel9 +21
  • RHSA-2023:4421 Released 2023-08-01 · Red Hat rating Important
    OpenShift Virtualization 4.12.5 security and bug fix update
    • CNV 4.12 for RHEL 8 container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins +40
  • RHSA-2023:4290 Released 2023-07-27 · Red Hat rating Moderate
    OpenShift sandboxed containers 1.4.1 security update
    • OpenShift Sandboxed Containers 1.4 openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9, openshift-sandboxed-containers/osc-monitor-rhel9 +4
  • RHSA-2023:4286 Released 2023-07-26 · Red Hat rating Moderate
    Red Hat OpenShift Dev Spaces Security Update
    • Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/configbump-rhel8, devspaces/dashboard-rhel8 +10
  • RHSA-2023:4287 Released 2023-07-26 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.12.5 security and bug fix update
    • RHODF 4.12 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-operator-bundle +20
  • RHSA-2023:4276 Released 2023-07-25 · Red Hat rating Moderate
    DevWorkspace Operator Security Update
    • Devworkspace 1.0 for RHEL 8 devworkspace/devworkspace-operator-bundle, devworkspace/devworkspace-project-clone-rhel8, devworkspace/devworkspace-rhel8-operator
  • RHSA-2023:4093 Released 2023-07-20 · Red Hat rating Important
    OpenShift Container Platform 4.13.5 security update
    • Red Hat OpenShift Container Platform 4.13 openshift-4.13.0-202307132344.p0.gf245ced.assembly.stream.el8, openshift-4.13.0-202307132344.p0.gf245ced.assembly.stream.el9, openshift-clients-4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8 +5
  • RHSA-2023:4241 Released 2023-07-20 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.10.14 security and bug fix update
    • RHODF 4.10 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-operator-bundle +21
  • RHSA-2023:4238 Released 2023-07-20 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.11.9 security and bug fix update
    • RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-operator-bundle +23
  • RHSA-2023:4114 Released 2023-07-17 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh Containers for 2.4.1 security update
    • RHOSSM 2.4 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +6
  • RHSA-2023:4113 Released 2023-07-17 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh Containers for 2.3.5 security update
    • RHOSSM 2.3 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +5
  • RHSA-2023:4112 Released 2023-07-17 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.2.8 security update
    • RHOSSM 2.2 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +5
  • RHSA-2023:3924 Released 2023-07-06 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.23 security update
    • Red Hat OpenShift Container Platform 4.12 openshift-4.12.0-202306251254.p0.gc43ddea.assembly.stream.el8, openshift-4.12.0-202306251254.p0.gc43ddea.assembly.stream.el9, openshift-ansible-4.12.0-202306230041.p0.g74dc7b3.assembly.stream.el8 +3
  • RHSA-2023:3925 Released 2023-07-06 · Red Hat rating Moderate
    Red Hat OpenShift Enterprise security update
    • Red Hat OpenShift Container Platform 4.12 openshift-tech-preview/metallb-rhel8, openshift4/cloud-event-proxy-rhel8, openshift4/cloud-network-config-controller-rhel8 +47
  • RHSA-2023:3910 Released 2023-07-06 · Red Hat rating Important
    Red Hat OpenShift Enterprise security update
    • Red Hat OpenShift Container Platform 4.10 containers-common-1:1.2.4-1.1.el8, openshift-4.10.0-202306170106.p0.g16bcd69.assembly.stream.el7, openshift-4.10.0-202306170106.p0.g16bcd69.assembly.stream.el8 +10
  • RHSA-2023:3914 Released 2023-07-06 · Red Hat rating Important
    Red Hat OpenShift Enterprise security update
    • Red Hat OpenShift Container Platform 4.11 buildah-1:1.23.4-3.rhaos4.11.el8, buildah-tests-1:1.23.4-3.rhaos4.11.el8, openshift-4.11.0-202306260054.p0.g990d55b.assembly.stream.el8 +12
  • RHSA-2023:3911 Released 2023-07-06 · Red Hat rating Important
    OpenShift Container Platform 4.10.63 security update
    • Red Hat OpenShift Container Platform 4.10 openshift-tech-preview/metallb-rhel8, openshift4/bare-metal-event-relay-rhel8-operator, openshift4/baremetal-hardware-event-proxy-rhel8 +47
  • RHSA-2023:3915 Released 2023-07-06 · Red Hat rating Important
    OpenShift Container Platform 4.11.44 bug fix and security update
    • Red Hat OpenShift Container Platform 4.11 openshift-tech-preview/metallb-rhel8, openshift4/cloud-event-proxy-rhel8, openshift4/cloud-network-config-controller-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
CNV 4.11 for RHEL 8Fixed RHSA-2023:5103
CNV 4.12 for RHEL 8Fixed RHSA-2023:4421
CNV 4.13 for RHEL 9Fixed RHSA-2023:4664
Devworkspace 1.0 for RHEL 8Fixed RHSA-2023:4276
OpenShift Sandboxed Containers 1.4Fixed RHSA-2023:4290
RHODF 4.10 for RHEL 8Fixed RHSA-2023:4241
RHODF 4.11 for RHEL 8Fixed RHSA-2023:4238
RHODF 4.12 for RHEL 8Fixed RHSA-2023:4287
RHODF 4.13 for RHEL 9Fixed RHSA-2023:4437
RHOSSM 2.2 for RHEL 8Fixed RHSA-2023:4112
RHOSSM 2.3 for RHEL 8Fixed RHSA-2023:4113
RHOSSM 2.4 for RHEL 8Fixed RHSA-2023:4114
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:3910, RHSA-2023:3911
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2023:3914, RHSA-2023:3915
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:3924, RHSA-2023:3925
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:4093, RHSA-2023:4456
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:5006, RHSA-2023:5009
Red Hat OpenShift Dev Spaces 3Fixed RHSA-2023:4286
Red Hat OpenShift Serverless 1.0Fixed RHSA-2023:4471
Red Hat OpenShift Serverless 1.29Fixed RHSA-2023:4472
Not affected: 10 products
  • CNV 4.11 for RHEL 8
  • CNV 4.13 for RHEL 9
  • Ironic content for Red Hat OpenShift Container Platform 4.13
  • Ironic content for Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3089
  2. 2026-10-03 Alias added: GHSA-wj5p-x3cr-46w8

References

Advisory 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-34021 Linux kernel skb coalescing drops shared-frag marker KEVCVSS 3.1HIGH 7.8
  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
See all 340 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences