CVE-2023-0296

CVSS V2 None CVSS V3 None
Description
The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port (9979) on etcd grpc-proxy, hence this port might be considered as still vulnerable to the same type of vulnerability. The health checks on etcd grpc-proxy do not contain sensitive data (only metrics data), therefore the potential impact related to this vulnerability is minimal. The CVE-2023-0296 has been assigned to this issue to track the permanent fix in the etcd component.
Overview
  • CVE ID
  • CVE-2023-0296
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2023-01-17T21:15:15
  • Last Modified Date
  • 2023-02-13T04:53:23
Weakness Enumerations
CWE URL
CWE-327 http://cwe.mitre.org/data/definitions/327.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:redhat:openshift:4.11:*:*:*:*:*:*:* 1 OR
References
Reference URL Reference Tags
https://access.redhat.com/errata/RHSA-2022:7399
https://access.redhat.com/errata/RHSA-2023:0069
https://access.redhat.com/errata/RHSA-2023:0241
https://access.redhat.com/security/cve/CVE-2023-0296
https://bugzilla.redhat.com/show_bug.cgi?id=2161287 Issue Tracking
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-0296
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0296
History
Created Old Value New Value Data Type Notes
2023-01-17 22:18:09 Added to TrackCVE
2023-01-17 22:18:11 Weakness Enumeration new
2023-01-17 23:14:29 2023-01-17T23:01:04 CVE Modified Date updated
2023-01-17 23:14:29 Received Awaiting Analysis Vulnerability Status updated
2023-01-24 16:14:31 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2023-01-26 18:13:54 2023-01-26T15:51:10 CVE Modified Date updated
2023-01-26 18:13:54 Undergoing Analysis Analyzed Vulnerability Status updated
2023-01-26 18:13:56 CPE Information updated
2023-02-02 22:15:10 2023-02-02T21:22:47 CVE Modified Date updated
2023-02-02 22:15:10 Analyzed Modified Vulnerability Status updated
2023-02-02 22:15:11 The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port (9979) on etcd grpc-proxy, hence this port might be considered as still vulnerable to the same type of vulnerability. The health checks on etcd grpc-proxy do not contain sensitive data (only metrics data), therefore the potential impact related to this vulnerability is minimal. The CVE-2023-0296 has been assigned to this issue to track the permanent fix in the etcd component. The Birthday attack against 64-bit block ciphers (CVE-2016-2183) was reported for the health checks port (9979) on the etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port (9979) on etcd grpc-proxy. Therefore, this port might still be considered vulnerable to the same type of attack. The health checks on etcd grpc-proxy do not contain sensitive data, only metrics data. The potential impact related to this vulnerability is minimal. The CVE-2023-0296 has been assigned to this issue to track the permanent fix in the etcd component. Description updated
2023-02-02 22:15:11 References updated
2023-02-13 05:17:14 2023-02-13T04:53:23 CVE Modified Date updated
2023-02-13 05:17:15 The Birthday attack against 64-bit block ciphers (CVE-2016-2183) was reported for the health checks port (9979) on the etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port (9979) on etcd grpc-proxy. Therefore, this port might still be considered vulnerable to the same type of attack. The health checks on etcd grpc-proxy do not contain sensitive data, only metrics data. The potential impact related to this vulnerability is minimal. The CVE-2023-0296 has been assigned to this issue to track the permanent fix in the etcd component. The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port (9979) on etcd grpc-proxy, hence this port might be considered as still vulnerable to the same type of vulnerability. The health checks on etcd grpc-proxy do not contain sensitive data (only metrics data), therefore the potential impact related to this vulnerability is minimal. The CVE-2023-0296 has been assigned to this issue to track the permanent fix in the etcd component. Description updated