Description
A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | openshift | — | 4.12.0 |
| Red Hat | OpenShift Serverless | — | — |
| Red Hat | OpenShift Service Mesh 2.2.x | — | — |
| Red Hat | OpenShift Service Mesh 2.3.x | — | — |
| Red Hat | OpenShift Service Mesh 2.4 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — |
| Red Hat | Red Hat JBoss A-MQ Streams | — | — |
| Red Hat | Red Hat OpenShift Container Platform 3.11 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat Openshift Data Foundation 4 | — | — |
| Red Hat | Red Hat Openshift sandboxed containers | — | — |
| Red Hat | Red Hat OpenShift Virtualization 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Serverless 1 | openshift-serverless-clients | 1.8.1-6.el8 | RHSA-2023:4471 |
| Red Hat Openshift Ironic 4 | openstack-ironic +5 | 1:21.5.0-0.20231002130534.0df5961.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | openstack-ironic-inspector +4 | 11.5.0-0.20230706175125.193aa0d.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-automaton +1 | 3.1.0-0.20230608140652.a4f7631.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-cinderclient +1 | 9.3.0-0.20230608143053.f7a612e.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-cliff +2 | 4.3.0-0.20230608150702.72e81d7.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-debtcollector +1 | 2.5.0-0.20230308172820.a6b46c5.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-decorator +1 | 4.4.2-6.0.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-dracclient +1 | 8.0.0-0.20230308200614.9c7499c.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-fixtures +1 | 4.0.1-1.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-futurist +1 | 2.4.1-0.20230308173923.159d752.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-glanceclient +1 | 1:4.3.0-0.20230608143056.52fb6b2.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-hardware +2 | 0.30.0-0.20230308190813.f6ff0ed.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-ironic-lib +1 | 5.4.1-0.20230706172632.25d8671.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-ironic-prometheus-exporter +1 | 4.1.1-0.20230614150617.7b35627.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-keystoneauth1 +1 | 5.2.0-0.20230608152518.2e40bbf.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-keystoneclient +2 | 1:5.1.0-0.20230608141554.4763cd8.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-keystonemiddleware +1 | 10.3.0-0.20230608151410.92cdf8a.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-openstacksdk +2 | 1.2.0-0.20230608155226.b7ff031.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-os-service-types +1 | 1.7.0-0.20230308170555.0b2f473.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-os-traits +2 | 3.0.0-0.20230608152745.cff125c.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-osc-lib +2 | 2.8.0-0.20230608151456.db9cdc9.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-cache +3 | 3.4.0-0.20230608153448.a720016.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-concurrency +3 | 5.1.1-0.20230706190204.0af5942.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-config +1 | 2:9.1.1-0.20230608145954.515daab.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-context +2 | 5.1.1-0.20230608143931.7696282.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-db +3 | 12.3.1-0.20230608142355.b689b63.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-i18n +2 | 6.0.0-0.20230608140652.03605c2.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-log +3 | 5.2.0-0.20230608150750.16a8a42.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-messaging +2 | 14.3.1-0.20230608152013.0602d1a.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-middleware +3 | 5.1.1-0.20230608145931.7725ac9.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-policy +3 | 4.2.0-0.20230608153320.93129eb.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-rootwrap +2 | 7.0.1-0.20230608144658.b72372b.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-serialization +2 | 5.1.1-0.20230608144505.b4be3a4.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-service +2 | 3.1.1-0.20230608145222.b3ba591.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-upgradecheck +1 | 2.1.1-0.20230608143829.eeedfc9.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-utils +1 | 6.1.0-0.20230608142355.d49d594.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-oslo-versionedobjects +1 | 3.1.0-0.20230608141554.b4ea834.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-osprofiler | 3.4.3-0.20230308173821.3286301.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-pbr | 5.11.1-0.1.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-proliantutils | 2.14.1-0.20230608154738.3de2844.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-pycadf +1 | 3.1.1-0.20230308171749.4179996.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-requestsexceptions | 1.4.0-0.20230308170555.d7ac0ff.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-scciclient | 0.12.3-0.20230308201513.0940a71.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-stevedore | 5.1.0-0.20230608154210.2d99ccc.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-sushy | 4.5.0-0.20230719180619.146ed33.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-sushy-oem-idrac | 5.0.0-0.20230308202122.da9a0e4.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-swiftclient | 4.3.0-0.20230608151934.236c277.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-tenacity | 6.3.1-1.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-tooz | 4.1.0-0.20230608154038.d5bf20c.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python-wrapt +1 | 1.14.1-1.el9 | RHSA-2023:5009 |
| Red Hat Openshift Ironic 4 | python3-ironic-python-agent +2 | 9.5.0-0.20230728140546.fce0b8c.el9 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | afterburn +2 | 5.4.3-1.rhaos4.14.el9 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | bpftool | 7.0.0-284.36.1.el9_2 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | buildah +1 | 1:1.23.4-3.rhaos4.11.el8 | RHSA-2023:5009, RHSA-2023:3914 |
| Red Hat OpenShift 4 | butane +1 | 0.19.0-1.1.rhaos4.14.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | catch +1 | 3.3.2-1.el9 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | conmon | 3:2.1.7-3.1.rhaos4.14.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | container-selinux | 3:2.221.0-1.rhaos4.14.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | containernetworking-plugins | 1.0.1-11.1.rhaos4.14.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | coreos-installer +2 | 0.17.0-1.rhaos4.14.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | cri-o | 1.27.1-8.1.rhaos4.14.git3fecb83.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | cri-tools | 1.27.0-2.1.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | crun | 1.9.2-1.rhaos4.14.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | crun-wasm | 0.0-3.rhaos4.14.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | fmt +1 | 9.1.0-1.el9 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | gmock +3 | 1.13.0-1.el9 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | google-benchmark +2 | 1.8.2-1.el9 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | haproxy +1 | 2.6.13-1.rhaos4.14.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | ignition +1 | 2.16.2-1.1.rhaos4.14.el9 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | kata-containers | 3.1.3-4.rhaos4.14.el9 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | kernel-rt +21 | 5.14.0-284.36.1.rt14.321.el9_2 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | nmstate +4 | 2.2.12-1.rhaos4.14.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | openshift +1 | 4.10.0-202306170106.p0.g16bcd69.assembly.stream.el7 | RHSA-2023:5009, RHSA-2023:4093, RHSA-2023:3924 |
| Red Hat OpenShift 4 | openshift-ansible +1 | 4.11.0-202306230041.p0.g0a466d7.assembly.stream.el8 | RHSA-2023:5009, RHSA-2023:3924, RHSA-2023:3914 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8 | RHSA-2023:5009, RHSA-2023:4093 |
| Red Hat OpenShift 4 | openshift-kuryr +4 | 4.14.0-202309272140.p0.g8926a29.assembly.stream.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | openshift-prometheus-promu +1 | 0.15.0-15.1.gitd5383c5.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | openshift4-aws-iso | 4.14.0-202309272140.p0.gd2acdd5.assembly.stream.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | ovn23.09 +3 | 23.09.0-37.el9fdp | RHSA-2023:5009 |
| Red Hat OpenShift 4 | perf +60 | 5.14.0-284.36.1.el9_2 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | podman +5 | 3.2.3-1.1.rhaos4.10.el8 | RHSA-2023:5009, RHSA-2023:3914, RHSA-2023:3910 |
| Red Hat OpenShift 4 | podman-gvproxy | 3:4.4.1-10.1.rhaos4.14.el8 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | runc | 3:1.1.2-2.rhaos4.11.el8 | RHSA-2023:5009, RHSA-2023:3914 |
| Red Hat OpenShift 4 | skopeo +2 | 1:1.2.4-1.1.el8 | RHSA-2023:5009, RHSA-2023:3914, RHSA-2023:3910 |
| Red Hat OpenShift 4 | spdlog +1 | 1.12.0-1.rhaos4.14.el9 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | toolbox | 0.1.2-1.rhaos4.14.el9 | RHSA-2023:5009 |
| Red Hat OpenShift 4 | wasmedge +2 | 0.12.1-2.rhaos4.14.el9 | RHSA-2023:5009 |
Advisories 7
- RHSA-2023:5009 Red Hat Security Advisory: OpenShift Container Platform 4.14.0 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:4093 Red Hat Security Advisory: OpenShift Container Platform 4.13.5 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:3914 Red Hat Security Advisory: Red Hat OpenShift Enterprise security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:3910 Red Hat Security Advisory: Red Hat OpenShift Enterprise security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:4471 Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.29.1 Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2023:3924 Red Hat Security Advisory: OpenShift Container Platform 4.12.23 security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- WID-SEC-2023-1675 Red Hat OpenShift: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jan 1, 2024
References
- https://access.redhat.com/security/cve/CVE-2023-3089 vdb-entry
- RHBZ#2212085 issue-tracking