RHSA-2024:3621HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift distributed tracing 3.2.0 operator/operand containers update

Published
June 5, 2024
Last Modified
August 22, 2026

🔗 CVE IDs covered (8)

CVE-2024-24783 →CVE-2024-24784 →CVE-2024-24785 →CVE-2024-24786 →CVE-2023-45286 →CVE-2023-45288 →CVE-2023-45289 →CVE-2023-45290 →

📋 Description

CVE-2023-45286 — go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2 CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45289 — golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect CVE-2023-45290 — golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm CVE-2024-24783 — golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm CVE-2024-24784 — golang: net/mail: comments in display names are incorrectly handled CVE-2024-24785 — golang: html/template: errors returned from MarshalJSON methods may break template escaping CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON

🎯 Affected products77

  • Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-agent-rhel8@sha256:27792a6b4e0aa3a1620e1ec98e2060fae5de6c239e60d5dc6e124662080ce7d9_arm64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-agent-rhel8@sha256:ae9746e42b1522e4cbae8060db136340543790e452c5872da35c29f57706901d_amd64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-agent-rhel8@sha256:c23914b0cc1670fee56143e59cce8d381c38ab8c2a215371eccb2c7e55049884_s390x as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-agent-rhel8@sha256:d8a55508e2b685367d9452565a6a8f9ab9970d2b48184961bdb09bf7cc693873_ppc64le as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-all-in-one-rhel8@sha256:1d0b55cbbaa33b53753259bbaedd57de3855ffc1e7db34f29b2d63df1b61a49a_amd64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-all-in-one-rhel8@sha256:5c21a151c7c26f2034faa1e389a0e826385f87962af02a842c547c71ffc98717_ppc64le as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-all-in-one-rhel8@sha256:bc9558144a4364e99a434675aba9abe9c8a21b3cae3fce211f41b48ac77e5c9c_arm64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-all-in-one-rhel8@sha256:f78cbbb9e49f3d97bbcb7401ef11f6dcdefaca998f99a5316f2a875c13bd961e_s390x as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-collector-rhel8@sha256:07f636db696baff7866fb4940d63e83cc0677406ce1c16eafb1bca103d6b79f3_ppc64le as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-collector-rhel8@sha256:205ab4f1c0af638ed46ade4150710c46d53d53033e70dbbdbc59f1e5049809e8_amd64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-collector-rhel8@sha256:de513774bafbe13f28269ef398c0fcbce17ef06dcd9e1190f592dd5aab727f41_s390x as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-collector-rhel8@sha256:ece5d3c01ed8ef464ca65cfd9e831eeec4d6f31bd3cc4091360aea7d319e639f_arm64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-es-index-cleaner-rhel8@sha256:50eda5a5ac77cbe807f37044a9de9679d724508388abffed13ffef79b62e8d81_ppc64le as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-es-index-cleaner-rhel8@sha256:c6363e9d1b807e1ad598ee6541c11090db20cc3fbee08e8532348218de6eaf88_amd64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-es-index-cleaner-rhel8@sha256:ca1211cf71262694bb32930e2bc290ec25bf7ee4abe705dccd93c84c01da7eca_s390x as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-es-index-cleaner-rhel8@sha256:eec0d1b9744193f951a5953a9ec4c15979b1a8fee5ed9b37f65d4f0ff115fb73_arm64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-es-rollover-rhel8@sha256:1091e265a40b4569dd480923286e137e251fae6ecac7428a085274a53f9b6db5_amd64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-es-rollover-rhel8@sha256:2463ea0e593a8efde7dc084ac6c600605542fcda7132355486120bceb410a6e2_arm64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-es-rollover-rhel8@sha256:9029cfb58fd669dd4fd701c8854310d36db4109ace6ba85b4e3193447bb2e502_s390x as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-es-rollover-rhel8@sha256:ed10dd0093277b3daeab8213e3d318953aabcd3dd9bc17f0e5e8116f8f51b1e2_ppc64le as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-ingester-rhel8@sha256:20ef07b52fd87c442138fdd52d39162deb10d8bb32766a1c837c9380ed1ddefe_arm64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-ingester-rhel8@sha256:827fb6fc29ad955af6f14f79956d0f3bec745f8c13518a1f140f7408558d12fe_s390x as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-ingester-rhel8@sha256:8f094de652472f0cabbf955e7aedf53b223d1976e4bb59d6decb2742b6ca3ec5_ppc64le as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-ingester-rhel8@sha256:ffb39ba0786e2713b0ad90772178997815a202cf620ceb667065642df823e2cd_amd64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-operator-bundle@sha256:760dfab4b65dce1a6a031ee394bc82b1f2701e6bb4b613ca2eeb82046717eeee_s390x as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-operator-bundle@sha256:a34a6d931dd7197210c7406a24c182ddf4a0c6fb2c078224ac2cbb627204078f_ppc64le as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-operator-bundle@sha256:e6bdfda1fc7a64452e02a22225849deae558c0a965880ff17d999532453e5254_amd64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-operator-bundle@sha256:e8a90eae01013ce7573d132d48bb3590b762b7d8a11740342d0762852ddb6c35_arm64 as a component of Red Hat OpenShift distributed tracing 3.2
  • rhosdt/jaeger-query-rhel8@sha256:1fe9ba6c2f4b11a0cd15613465f511ea442f4f62955fd54859d1dceddc211e9e_arm64 as a component of Red Hat OpenShift distributed tracing 3.2
  • +47 more not shown

✅ Remediation

Red Hat OpenShift distributed tracing Release Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (52)