CVE-2023-3089: Ocp & fips mode

Published Jun 3, 2023
·
Updated

A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

Affected Software

36 affected componentsFixes available
redhat/openshift<4.12.0
4.12.0
redhat OpenShift Container Platform=4.10
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
redhat Openshift Container Platform For Linuxone=4.10
redhat Openshift Container Platform For Linuxone=4.11
redhat Openshift Container Platform For Power=4.10
redhat Openshift Container Platform For Power=4.11
redhat Openshift Container Platform Ibm Z Systems=4.10
redhat Openshift Container Platform Ibm Z Systems=4.11
redhat Openshift Container Platform For Arm64=4.10
redhat Openshift Container Platform For Arm64=4.11
redhat Openshift Container Platform For Arm64=4.12
redhat Openshift Container Platform For Linuxone=4.12
redhat Openshift Container Platform For Power=4.12
redhat Openshift Container Platform Ibm Z Systems=4.12
redhat Enterprise Linux=9.0
All of the following
redhat OpenShift Container Platform=4.10
Any of the following
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
All of the following
Any of the following
redhat Openshift Container Platform For Linuxone=4.10
redhat Openshift Container Platform For Linuxone=4.11
redhat Openshift Container Platform For Power=4.10
redhat Openshift Container Platform For Power=4.11
redhat Openshift Container Platform Ibm Z Systems=4.10
redhat Openshift Container Platform Ibm Z Systems=4.11
redhat Enterprise Linux=8.0
All of the following
Any of the following
redhat Openshift Container Platform For Arm64=4.12
redhat Openshift Container Platform For Linuxone=4.12
redhat Openshift Container Platform For Power=4.12
redhat Openshift Container Platform Ibm Z Systems=4.12
Any of the following
redhat Enterprise Linux=8.0
redhat Enterprise Linux=9.0
All of the following
redhat Openshift Container Platform For Arm64=4.12
Any of the following
redhat Enterprise Linux=8.0
redhat Enterprise Linux=9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/openshift to a version that resolves this vulnerability.

    Fixed in 4.12.0

Event History

Jul 5, 2023
CVE Published
via MITRE·12:21 PM
Data Sourced
via MITRE·12:21 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is CVE-2023-3089?

CVE-2023-3089 is a compliance problem found in the Red Hat OpenShift Container Platform where not all cryptographic modules in use were FIPS-validated when FIPS mode was enabled.

2

What is the severity of CVE-2023-3089?

CVE-2023-3089 has a severity rating of high, with a CVSS score of 7.5.

3

Which software versions are affected by CVE-2023-3089?

The Red Hat OpenShift Container Platform versions 4.10, 4.11, and 4.12 are affected by CVE-2023-3089.

4

How can I fix CVE-2023-3089?

To fix CVE-2023-3089, update the affected Red Hat OpenShift Container Platform to version 4.12.0.

5

Where can I find more information about CVE-2023-3089?

You can find more information about CVE-2023-3089 on the Red Hat Bugzilla and Red Hat Customer Portal.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203