RHSA-2024:10917HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release

Published
December 10, 2024
Last Modified
September 6, 2026

🔗 CVE IDs covered (9)

CVE-2024-45812 →CVE-2024-43800 →CVE-2024-45590 →CVE-2024-45811 →CVE-2024-47068 →CVE-2024-21536 →CVE-2024-43796 →CVE-2024-43799 →CVE-2024-45296 →

📋 Description

CVE-2024-21536 — http-proxy-middleware: Denial of Service CVE-2024-43796 — express: Improper Input Handling in Express Redirects CVE-2024-43799 — send: Code Execution Vulnerability in Send Library CVE-2024-43800 — serve-static: Improper Sanitization in serve-static CVE-2024-45296 — path-to-regexp: Backtracking regular expressions cause ReDoS CVE-2024-45590 — body-parser: Denial of Service Vulnerability in body-parser CVE-2024-45811 — vite: server.fs.deny is bypassed when using ?import&raw CVE-2024-45812 — vite: XSS via DOM Clobbering gadget found in vite bundled scripts CVE-2024-47068 — rollup: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

🎯 Affected products34

  • Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:05b0c8b5f7717aa00aecf8415c5a79aaae45fdd921f16b9b717b715abdf3d86b_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:204972905b60ab8957c9bdc79a68be864b7b1e4e946c557fe3529124ad987abc_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:6d56211c0cc55af6cf64b0dcb27a733994febfbf24457bb14d658db98b4dcb90_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:7b0708b8375d637c822a10733cd97fdddfd6ed1717dd83a37b50f43f28a71444_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-all-in-one-rhel8@sha256:10857fa228035950b7ee78de526d99f4353b0bdf6f67e8412baa93d7bb8455fc_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-all-in-one-rhel8@sha256:3a9c36576f625c796e193b7f457c05adfb2bf7fe27a4a20c8dc3239d7d7d749b_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-all-in-one-rhel8@sha256:7db951f4309125ffaf31b315dcbfaaf2a94e33e0bad34a6a98dcdf7b9b5ae76a_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-all-in-one-rhel8@sha256:b7643356dd52ad18bea1b817b192708735794f5536bf86903f7721b07095d949_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-collector-rhel8@sha256:0680a79d33d1be64996ef1713f357a03304525adda3a5b1bd902515015afe3e2_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-collector-rhel8@sha256:153a6c2b46a236577f57863da350c3f89595ecf0de6dd56eb8090741b83f6d10_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-collector-rhel8@sha256:60028cdb647f96cc8e3a49f11428a8d35b44937fdd6c6b8bafbd70d6a0a45fd6_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-collector-rhel8@sha256:912550520b81f9fcf68400dfd76d7a85f68a3fce5e95e34ee5a22a32fb5d3871_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:25dc148e3a956b8ee742d0702a0c3b5e978fefc4f1f080cf2bb273e115044303_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:2c4aafdd152511477c2bfbe1f4bc3545785e1cec7a510e9632bc9d72ea624f83_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:7975ba7f7952a874767ae327f8046c924a797cf3a60fbd21070fe3098c5493b9_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:fdb227f5425459de46782922f53ba147f67ea0a86ef2143b9b5d9bd15ba2958e_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-rollover-rhel8@sha256:2372370502da86ba88aed909bcc1e768377bf540def547fe663e7b727c7ab07d_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-rollover-rhel8@sha256:8b8554063d8dde0c192b7a936515d4f7a3024c4f44a1c508d3d1c43cb54746cc_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-rollover-rhel8@sha256:aebb7c234a589c94449a25d779b83f29ea94a67d9a15f6e5e1fa7cbb7379faa0_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-rollover-rhel8@sha256:f454ee35013e250d97ccf8fbd72392932a7b3cb56bc0a1e8d40e39716b41573e_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-ingester-rhel8@sha256:bf8fc9009a8c2ee43c1795d9408b0b385cd99ad0601c50e1e79e6df11f57880d_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-ingester-rhel8@sha256:c322e17e36003bba01af3583da5c5a5673681f47a27a3c4624353f449fbbfe80_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-ingester-rhel8@sha256:f2394fa49c88dd115e54de9ce42ceb6178bff1d0a2e6a1d355dc60ba77c5323c_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-ingester-rhel8@sha256:f5fbc78661bb8f6b091c521c46973aaa296e0534325d753c47a14309e06c2279_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-operator-bundle@sha256:e65dce4728a53af4e696d09b05b60a731ecb8cdba19332deb16c291f61adcdb4_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-query-rhel8@sha256:56784b527bf1fc1a2a0f24ea9b6edea3927746cbe1b18d9c653e0be621f07911_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-query-rhel8@sha256:59183275cf68d933b5eb3690ae89aacfb9e34ee85868e7a1f858684cff6dcd20_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-query-rhel8@sha256:648d95c1a6736055910cd901c7e80d82d0e8bad71531373293144d0d6682b994_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-query-rhel8@sha256:7ce3c91962c904cffc5446c0ba6263124ea4b8a17963fbbefabacac73daf4851_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • +4 more not shown

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/h tml/operators/administrator-tasks#olm-upgrading-operators Workaround: Red Hat Product Security does not have any mitigation recommendations at this time. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (12)