RHSA-2025:1609HighCVSS 7.5

Red Hat Security Advisory: Cluster Observability Operator 1.0.0

Published
February 17, 2025
Last Modified
September 8, 2026

🔗 CVE IDs covered (3)

CVE-2023-26159 →CVE-2024-28849 →CVE-2024-45338 →

📋 Description

CVE-2023-26159 — follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() CVE-2024-28849 — follow-redirects: Possible credential leak CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html

🎯 Affected products54

  • Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel8@sha256:0a139fd0231b44aabc33627173ee98d0ebf1297b301cffb88520fa0c266419c6_s390x as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel8@sha256:4219479d343e0889653411dd663eba93be633882c6ac5f2c4e91e06050e35e62_amd64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel8@sha256:b7731d5dd9e0e08c5926d0f9f54a0d67e8b9a4cc0b805c5ddab9f28ca958c299_ppc64le as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel8@sha256:ebe029f66906c1af08cedebf6f3b785f05c72742b95d7fa3d0596835dcc69894_arm64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:221e3514c869644f63e03c58467648cfc2a241de976941e29f1ae4492d2d6e0a_amd64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel8-operator@sha256:14ec62625ed452a305b532556f8c9e5edfec36603221b55e364b5ff3a336577f_s390x as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel8-operator@sha256:47d961fc88adbc2b0cd49cca5215632f31bcc023ccc223147492d6de78f3c51f_ppc64le as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel8-operator@sha256:d186268cdfcf15cc98e28555eef9b0cb6d082e3a9561346f05da62dd74bfdf32_arm64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel8-operator@sha256:fd934560d184639a5c9567e53cce0f8e863476c0f59f846e2ffd4d8bff9a672c_amd64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-0-3-rhel9@sha256:10e2cc68db50f7018d14a28dcefa844fc67a3893c0ca665dfa7c53838c9d8515_amd64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-0-3-rhel9@sha256:6481c593929a608b834f34fca5be1d4e916be06911b98a17e66af7064cff85a9_arm64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-0-3-rhel9@sha256:d38206b54d32b8a64140fb2a9c5cfc94c01ca68d80a67074402e8ce713d3a475_ppc64le as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-0-3-rhel9@sha256:e36b3235b4f7627c762a477afd9b10da396d8b46bceeaab38107adce48cfde50_s390x as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-0-3-rhel9@sha256:0e8c4695e653d1092ba755f7c2868fad66370077bf3f39ef7626383a0f69490c_s390x as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-0-3-rhel9@sha256:39937748a620f7ff84c16b70d1888ffa2b37ca9820a7f8b9f2149db74ad3cd94_ppc64le as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-0-3-rhel9@sha256:5068b1796ba0a7e90e1be27adf259ecbcfd87d19b18a8a2fb999d8139a71f21a_amd64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-0-3-rhel9@sha256:a93ba2a7698ecde1de60ea629e9ed38da648e25ab46fa005bfb00d232e283935_arm64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/korrel8r-rhel8@sha256:6d86eced25a2fb454c21183748d98feac0192d30178e8fc1dc21cfa5387635e6_s390x as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/korrel8r-rhel8@sha256:7ef29756f54d1e7e50d2b3ade6a2e3cc7e0d2d6a7e118e02acc8cfabd14abf60_ppc64le as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/korrel8r-rhel8@sha256:857195f1a5ac1b142ceaa62eef963340eb8438b0d160aa4d5d3ac04975fcee60_arm64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/korrel8r-rhel8@sha256:a4390e0455b330c66be3046f0c475206e159b9e579726ad7eaae588115c5ac47_amd64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/logging-console-plugin-6-0-rhel9@sha256:2d65b9b24c4f140d92c8e1546da0efd9cd34b7a9484b0b0e74cd0b5514a82e1d_s390x as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/logging-console-plugin-6-0-rhel9@sha256:39b25b2a76b1b733479920b06782c042fdee70a6bb216cfe7008045850126946_arm64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/logging-console-plugin-6-0-rhel9@sha256:55708cd50ae3df2238f31fa59cd4c3b5b3c223931631472501b82cf75350da53_ppc64le as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/logging-console-plugin-6-0-rhel9@sha256:78b630e98b1a8afd58f8f2c8d9147fe359cfbdb1942fb8da1dba28c98fe528aa_amd64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-0-3-rhel9@sha256:0341fc1043370ddd9fbe7a9578315a6ab5ed0443dd6405a4a5d1e9e0c99ce0c6_amd64 as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-0-3-rhel9@sha256:354a21013692c072241990054fb60f55f31f7f4d1a9f67dfb80649e87d978329_s390x as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-0-3-rhel9@sha256:4f3941afe98e78477cad6d35161590ceae198b9ba021ee1c0fb0dca8efb50648_ppc64le as a component of Cluster Observability Operator 1.0.0
  • registry.redhat.io/cluster-observability-operator/monitoring-console-plugin-0-3-rhel9@sha256:c50105566c0a684e210747cc0aed4958cd102f6927efd80f98919f2a210ec146_arm64 as a component of Cluster Observability Operator 1.0.0
  • +24 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (7)