#VU78005 Inadequate Encryption Strength in Red Hat OpenShift Container Platform - CVE-2023-3089

Vulnerability identifier: #VU78005

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-3089

CWE-ID: CWE-326

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Red Hat OpenShift Container Platform
Client/Desktop applications / Software for system administration

Vendor: Red Hat Inc.

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists within the OpenShift container platform configuration with enabled FIPS mode, which resulted in usage of not validated cryptographic modules. A remote attacker can perform various attacks against not validated cryptographic modules and gain access to sensitive information.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.10 - 4.10.62

---

External links
https://access.redhat.com/security/cve/CVE-2023-3089
https://bugzilla.redhat.com/show_bug.cgi?id=2212085

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.