etcd grpc-proxy vulnerable to The Birthday attack against 64-bit block cipher
CVE: CVE-2023-0296
Component: openshift
CWE: CWE-327
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2023-01-16T00:00:00+00:00

The Birthday attack against 64-bit block ciphers (CVE-2016-2183) was reported for the health checks port (9979) on the etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port (9979) on etcd grpc-proxy. Therefore, this port might still be considered vulnerable to the same type of attack. The health checks on etcd grpc-proxy do not contain sensitive data, only metrics data. The potential impact related to this vulnerability is minimal. 
The CVE-2023-0296 has been assigned to this issue to track the permanent fix in the etcd component.


Remediation:
For OpenShift Container Platform 4.10 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags

The sha values for the release are:

(For x86_64 architecture)
The image digest is sha256:9301ca818d705bda5981db961904f2b6e3f9adcc51e3c8e258c05950236dfc3d

(For s390x architecture)
The image digest is sha256:88dd6c214ba12eb626301d40fadbf5d6d95eeaebae11f0c0fedfbfcecd1df739

(For ppc64le architecture)
The image digest is sha256:baa7fe33ac04eca046892820342c19b6df02f6998f3f5e4f9471c737f6eeb301

(For aarch64 architecture)
The image digest is sha256:7ac01bfe3554059f81fb573fa04cf41ca8a150b93b54d4209f4c987687e40d81

All OpenShift Container Platform 4.10 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
at
https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:
  https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags

The SHA values for the release are:
  
(For x86_64 architecture)
  The image digest is sha256:24a273f879d6eed8d6cce1426798a623ebbe095e01a881e58aa78c4e9eff0c8b
  
(For s390x architecture)
  The image digest is sha256:620f3b21d5157c3223c0a45aae2fc3aac0d11f1d561f025e3d5730f628c95e05
  
(For ppc64le architecture)
  The image digest is sha256:96eebd99bc9ba668447ffce90eb887012d000edfeca3994a4726fb72ef314b88
  
(For aarch64 architecture)
  The image digest is sha256:a57a6844a0d6506309b3bb7bc3883384c907ffa331008423b32f4f3633795494

All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html
See the following documentation, which will be updated shortly for this
release, for important instructions on how to upgrade your cluster and
fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, aarch64 architectures.

The image digests may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags

The sha values for the release are:

(For x86_64 architecture)
The image digest is sha256:4c5a7e26d707780be6466ddc9591865beb2e3baa5556432d23e8d57966a2dd18

(For s390x architecture)
The image digest is sha256:ab70750be4fadf5a525141ae32a8577c91dd19f1d6e582a6824339c938216ec0

(For ppc64le architecture)
The image digest is sha256:5a5943dea60b40f73ecee685b12fff1d65cc8bfe946f762fdfe862969483ddbb

(For aarch64 architecture)
The image digest is sha256:cb34667519d1cfd8eedf0fb27e14b7b7e6209323b86977bfaadf91da012d179d

All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
at
https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html

You can download the oc tool and use it to inspect release image metadata
for x86_64, s390x, and ppc64le architectures.

The image digests can be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are:

(For x86_64 architecture)
The image digest is sha256:cdf6e83f94d6a9beec65a429ebea6a8f5f80c19df49feb1a78b17981132b922b

(For s390x architecture)
The image digest is sha256:4784b43052f3041059e2cc586f2c3c80591ff92338817a83d3039288e1258eef

(For ppc64le architecture)
The image digest is sha256:5f1124780604fb8de06732bd407c24ac5d6d47df52ec74531d803bd187363bcf

(For aarch64 architecture)
The image digest is sha256: 2595defd3ac3d1b41acbf3284d9bf3eb73ac1f58aecffa77e82766e90ee511dc

All OpenShift Container Platform 4.9 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at:
https://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html