Understanding of CVE-2023-48795 in OpenShift 4

Solution Verified - Updated 8 Jul 2026

Environment

Red Hat OpenShift Container Platform (RHOCP)
- 4
SSH Client and Server
Terrapin Attack

Issue

SSH access to OpenShift nodes displays the use of vulnerable ciphers as mentioned on the CVE-2023-48795 page.
Vulnerable ciphers such as chacha20-poly1305@openssh.com / hmac-sha2-512-etm@openssh.com / hmac-sha2-256-etm@openssh.com / hmac-sha1-etm@openssh.com / hmac-md5-etm@openssh.com are in use in OpenShift clusters.

Resolution

As shown in the CVE-2023-48795 page, the fix for this vulnerability was included in libssh packages libssh-0.10.4-9.el9_2 and libssh-0.10.4-12.el9_3, and in openssh packages openssh-8.7p1-30.el9_2.3 and openssh-8.7p1-34.el9_3.3. Those packages or newer versions are already included in all recent OpenShift 4 versions.

Refer to the Diagnostic Steps section to ensure that the libssh and openssh rpm versions included in the OpenShift environment include the fixes.

Note: it is also needed to check the openssh and libssh versions in the local machine doing SSH connections to the OpenShift node, as the fix includes client and server side kex pseudo-algorithms.

If vulnerability CVE-2023-48795 is identified in an OpenShift 4 cluster, please upgrade the OpenShift cluster to a recent and supported OpenShift version.

Upgrading individual packages in OpenShift

Red Hat OpenShift Container Platform 4 includes a fully managed node operating system, Red Hat Enterprise Linux CoreOS, commonly referred to as RHCOS, and RHCOS is based on RHEL. Article RHEL versions used by RHEL CoreOS and OpenShift helps to understand what is the RHEL version on top of which an OpenShift cluster is based upon.

Due to the above, it is important to note that upgrading the affected RPMs individually on RHCOS is not supported as explained in is it possible to manually upgrade a specific package in Red Hat Enterprise Linux CoreOS (RHCOS)?

Root Cause

The fix for this vulnerability was included in recent OpenShift 4 versions. For additional information, refer to the CVE-2023-48795 page.

Updated client and server provide kex pseudo-algorithms indicating usage of the updated version of the protocol which is protected from the attack. If kex-strict-c-v00@openssh.com is provided by client and kex-strict-s-v00@openssh.com is in the server's reply, that means version including the fixes are in use and are safe for this vulnerability.

Diagnostic Steps

Check the libssh and openssh packages used in all the nodes from the cluster:

$ for NODE in $(oc get node -o name); do echo "--- ${NODE} ---"; oc debug -q ${NODE} -- chroot /host bash -c "rpm -q libssh; echo; rpm -q openssh; echo; rpm -q libssh --changelog | grep -B1 2023-48795; echo ; rpm -q openssh --changelog | grep -B2 2023-48795"; done

The output will be similar to:

    [...]
    --- node/node-1 ---
    libssh-0.10.4-13.el9_4.1.x86_64

    openssh-8.7p1-38.el9_4.5.x86_64

    * Tue Jan 09 2024 Sahana Prasad <sahana@redhat.com> - 0.10.4-12
    - Fix CVE-2023-48795 Prefix truncation attack on Binary Packet Protocol (BPP)

    * Fri Jan 05 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-38
    - Fix Terrapin attack
      Resolves: CVE-2023-48795
    --
    * Fri Jan 05 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-37
    - Fix Terrapin attack
      Resolves: CVE-2023-48795
    --
    * Wed Dec 20 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-36
    - Fix Terrapin attack
      Resolves: CVE-2023-48795
    [...]

Note: if the versions are very recent, it is possible that the changelog for old fixes was truncated, and it is possible that any of the above commands fails with error: non-zero exit code from debug container. In those cases, ensure that the version of the packages is newer than the versions that include the fixes.

It is also needed to check that the versions used by the SSH client in the local machine doing the SSH connections to OpenShift nodes is up-to-date and include the fixes. The following command can be used:
```
$ rpm -q libssh; echo; rpm -q openssh; echo; rpm -q libssh --changelog | grep -B1 2023-48795; echo ; rpm -q openssh --changelog | grep -B2 2023-48795
```

If both client and server are up-to-date and contains the fixes, the following test can be also done:

Connect via SSH to a node of the OpenShift cluster using the below command:
```
$ ssh -vvv -i .ssh/id_rsa.pub core@ocp-node-name
```
Save the output into a file and then grep for the kex pseudo-algorithms kex-strict-c-v00@openssh.com and kex-strict-s-v00@openssh.com. If they are shown, versions of the openssh rpm that include the fixes are used in both client and OpenShift nodes, and are safe from this vulnerability.

SBR

Product(s)

Red Hat OpenShift Container Platform

Components

Category

Configure

Tags

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.