Issued:
2024-06-05
Updated:
2024-06-05

RHSA-2024:3621 - Important: Red Hat OpenShift distributed tracing 3.2.0 operator/operand containers update

Synopsis

Important: Red Hat OpenShift distributed tracing 3.2.0 operator/operand containers update

Type/Severity

Security Advisory Important

Topic

Red Hat OpenShift distributed tracing 3.2.0

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Release of Red Hat OpenShift distributed tracing provides these changes:

Security Fix(es):

  • go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2 (CVE-2023-45286)
  • golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
  • golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)
  • golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
  • golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
  • golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)
  • golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
  • golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Red Hat OpenShift distributed tracing Release

Affected Products

ProductVersionArch
Red Hat OpenShift distributed tracing3x86_64
Red Hat OpenShift distributed tracing for Power, little endian3ppc64le
Red Hat OpenShift distributed tracing for IBM Z and LinuxONE3s390x
Red Hat OpenShift distributed tracing for ARM3aarch64

Fixes

CVEs

References

Additional information