Red Hat OpenShift up to 4.11.6 Block Cipher risky encryption

Summaryinfo

A vulnerability labeled as problematic has been found in Red Hat OpenShift. Impacted is an unknown function of the component Block Cipher Handler. Executing a manipulation can lead to risky encryption. This vulnerability is tracked as CVE-2023-0296. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in Red Hat OpenShift (Virtualization Software). This vulnerability affects an unknown part of the component Block Cipher Handler. The manipulation with an unknown input leads to a risky encryption vulnerability. The CWE definition for the vulnerability is CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. As an impact it is known to affect confidentiality. CVE summarizes:

The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port (9979) on etcd grpc-proxy, hence this port might be considered as still vulnerable to the same type of vulnerability. The health checks on etcd grpc-proxy do not contain sensitive data (only metrics data), therefore the potential impact related to this vulnerability is minimal. The CVE-2023-0296 has been assigned to this issue to track the permanent fix in the etcd component.

The weakness was disclosed 01/18/2023. The advisory is shared for download at bugzilla.redhat.com. This vulnerability was named CVE-2023-0296 since 01/13/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading to version 4.12 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-12373). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Virtualization Software

Vendor

• Red Hat

Name

• OpenShift

Version

• 0.0.5
• 1
• 1.0
• 1.0.5
• 1.1
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.22.0
• 1.22.1
• 2
• 2.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.1
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.2
• 2.3.1
• 2.5.6
• 2.6.3
• 3.0
• 3.0.0.0
• 3.1
• 3.2
• 3.7
• 3.11
• 4
• 4.9.6
• 4.9.48
• 4.10.31
• 4.11.6

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion