- Issued:
- 2024-02-27
- Updated:
- 2024-02-27
RHSA-2024:0998 - Low: Red Hat OpenShift distributed tracing 3.1.0 operator/operand containers
Synopsis
Low: Red Hat OpenShift distributed tracing 3.1.0 operator/operand containers
Type/Severity
Security Advisory Low
Topic
Red Hat OpenShift distributed tracing 3.1.0
Red Hat Product Security has rated this update as having a security impact of "Low". A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
Release of Red Hat OpenShift distributed tracing provides these changes: OpenTelemetry: support for target allocator. Tempo: Monolithic CRD, alerting for span RED metrics, TraceQL support for gateway. OpenTelemetry version 0.93.0. Tempo 2.3.1, Jaeger 1.53.0.
Security Fix(es):
CVE-2023-26159 follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse()
Solution
Red Hat OpenShift distributed tracing Release
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat OpenShift distributed tracing | 3 | x86_64 |
| Red Hat OpenShift distributed tracing for Power, little endian | 3 | ppc64le |
| Red Hat OpenShift distributed tracing for IBM Z and LinuxONE | 3 | s390x |
| Red Hat OpenShift distributed tracing for ARM | 3 | aarch64 |
Fixes
- This content is not included.BZ - 2256413
- This content is not included.TRACING-3135
- This content is not included.TRACING-3573
- This content is not included.TRACING-3746
- This content is not included.TRACING-3756
- This content is not included.TRACING-3786
- This content is not included.TRACING-3787
- This content is not included.TRACING-3808
- This content is not included.TRACING-3810
- This content is not included.TRACING-3717
- This content is not included.TRACING-3718
- This content is not included.TRACING-3719
CVEs
- CVE-2021-35937
- CVE-2021-35938
- CVE-2021-35939
- CVE-2023-3446
- CVE-2023-3817
- CVE-2023-5678
- CVE-2023-7104
- CVE-2023-26159
- CVE-2023-39615
- CVE-2023-48795
- CVE-2024-0553
References
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.