Which 4.y.z to 4.y'.z' updates increase vulnerability?

4.12.23 and higher to 4.13.7 and lower

Which types of clusters?

FIPS-enabled clusters where remediation described in RHSB-2023-001 (certificate rotation) was already performed

What is the impact?

FIPS-enabled clusters where remediation described in RHSB-2023-001 (certificate rotation) was already performed would lose the remediation after updating to an impacted OCP4.13 version.

However, as of 2023-07-24, anyone needing FIPS compliance will likely not want to update to any version of OCP 4.13. OCP 4.13 uses RHEL9.2 binaries, and RHEL9.2 has not yet been submitted for FIPS validation (for up to date information, please see General FAQ for OpenShift and FIPS compliance ).

How involved is remediation?

Remediation described in RHSB-2023-001 (certificate rotation) would need to be re-done after the cluster is updated to 4.13.8 where the RHSB-2023-001 is resolved.

Is this a regression?

No.