CVE-2023-0296: Medium severity red hat openshift vulnerability
The Birthday attack against 64-bit block ciphers (CVE-2016-2183) was reported for the health checks port (9979) on the etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port (9979) on etcd grpc-proxy. Therefore, this port might still be considered vulnerable to the same type of attack. The health checks on etcd grpc-proxy do not contain sensitive data, only metrics data. The potential impact related to this vulnerability is minimal. The CVE-2023-0296 has been assigned to this issue to track the permanent fix in the etcd component.
Other sources
The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port (9979) on etcd grpc-proxy, hence this port might be considered as still vulnerable to the same type of vulnerability. The health checks on etcd grpc-proxy do not contain sensitive data (only metrics data), therefore the potential impact related to this vulnerability is minimal. The CVE-2023-0296 has been assigned to this issue to track the permanent fix in the etcd component.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-0296?
CVE-2023-0296 is a vulnerability known as the Birthday attack against 64-bit block ciphers, reported for the health checks port (9979) on the etcd grpc-proxy component.
What is the severity of CVE-2023-0296?
The severity of CVE-2023-0296 is medium, with a severity value of 5.3.
Which software is affected by CVE-2023-0296?
IBM Robotic Process Automation as a Service version 4.11 is affected by CVE-2023-0296.
How can I fix CVE-2023-0296?
To fix CVE-2023-0296, it is recommended to update the affected software to a version that has the fix applied.
Where can I find more information about CVE-2023-0296?
You can find more information about CVE-2023-0296 on the CVE website and the NVD website.