High

OpenShift FIPS Mode Non-Validated Cryptography

IdentifiersCVE-2023-3089CWE-327

CVE-2023-3089 is a FIPS-compliance defect in Red Hat OpenShift Container Platform. On clusters installed with FIPS mode enabled, certain Go-based OpenShift components used Go standard-library cryptographic modules instead of the required FIPS-validated OpenSSL cryptographic module. Consequently, cryptographic keys and certificates generated by affected components may not have been produced using FIPS-validated cryptography, and affected deployments cannot be considered FIPS compliant.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

The primary impact is loss of FIPS 140 compliance for affected OpenShift deployments, including environments subject to regulatory or contractual FIPS requirements. A subset of platform keys and certificates may have been generated by non-validated cryptographic modules and must be rotated to restore compliance after updating. No exploitable cryptographic weakness in Go's standard cryptographic library, loss of encryption for data at rest or in transit, or attacker-triggerable condition was identified.

Mitigation

If you can’t patch tonight, do this now.

No practical mitigation exists for an affected component other than applying corrected builds. Where operationally feasible, temporarily disable affected optional operators and layered products until fixed versions are available, then update and re-enable them. This does not remediate noncompliant keys or certificates already generated; regulated environments require post-update certificate rotation or reinstallation to restore compliance.

Remediation

Patch, then assume compromise.

Upgrade OpenShift Container Platform and all installed affected operators, layered products, and client components through the applicable Red Hat security errata and supported release channel. Fixed core releases include OpenShift Container Platform 4.10.63, 4.11.44, 4.12.23, and 4.13.5; customers should use the fixed release available for their supported minor-version stream and follow OpenShift Update Service guidance. Environments requiring continued FIPS compliance must rotate affected certificates after applying fixes. For the highest assurance that all key material was generated compliantly, reinstall the cluster from a FIPS-compliant installation system. Verify the corrected payload with the check-payload compliance-scanning tool where available.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Red HatOpenshift Container Platformapplication

Red HatOpenshift Container Platform For Arm64application

Red HatOpenshift Container Platform For Linuxoneapplication

Red HatOpenshift Container Platform For Powerapplication

Red HatOpenshift Container Platform Ibm Z Systemsapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

24 SOURCESView more in app

redhat accessNews

Jan 1, 2026

RHSA-2023:5006 - Security Advisory - Red Hat Customer Portal

OpenShift Container Platform vulnerability affecting FIPS mode.

redhat accessNews

Jan 1, 2026

RHSA-2023:5009 - Security Advisory - Red Hat Customer Portal

An OpenShift Container Platform vulnerability concerning operation in FIPS mode.

redhat accessNews

Jan 1, 2026

RHSA-2023:4226 - Security Advisory - Red Hat Customer Portal

Unknown

redhat accessNews

Jan 1, 2026

RHSA-2023:4456 - Security Advisory - Red Hat Customer Portal

A security vulnerability involving OpenShift Container Platform (OCP) operating in FIPS mode. The advisory provides no further technical impact details.

+20 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity