RHSA-2025:2789HighCVSS 8.1

Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.5.0 release

Published
March 13, 2025
Last Modified
October 23, 2026

🔗 CVE IDs covered (5)

CVE-2025-24528 →CVE-2025-24928 →CVE-2024-45336 →CVE-2024-56171 →CVE-2025-22866 →

📋 Description

CVE-2024-45336 — golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect CVE-2024-56171 — libxml2: Use-After-Free in libxml2 CVE-2025-22866 — crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec CVE-2025-24528 — krb5: overflow when calculating ulog block size CVE-2025-24928 — libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2

🎯 Affected products14

  • Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:12407a15fefa30bb851444d27b00e1815970ae085deca7c17537612ec9e4bff6_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:8b7455c14f26b80006568829343688b50ad1c563d339c35f70eb7d561499bc1c_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:92613ae031dd45d85151ff1bd0703ee6bbc6842133cdc51b274769122ea40ac8_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:f9ec6952abc11519409299f0dfffae3b520395cc122d1f2cd375d65492c6aed7_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:d23b9c8d0266de7ce5427d125b2749053d2e4b44d632e3eb484775a5eede41b0_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:7e0320614f3be4e8bb1442d5890d2a6cebaf0a1038599d6afbf50daca91e1d65_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:adb1f41e544331b0936c6591edb00c169a9e5a2592c12f6ee55aaab8786ff5ba_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:e2375ae72ddda9e05e66972adb7bf953bfbf220dcc8b36d6eb1ab76d9e96ff5d_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:ffd6b70068dd4d6bf7a835c0bbf5b934f26ff2b0f5755130dccb099340550083_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:0742729985d0b1ce925bdaaa92c2bb42272902f4c2e93038c0fcf171c7baf03f_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:bf3aa3e5522cf90d82fbd34710e08448a93b88a9876c77415a1027f83a195a81_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:cced4191c3e84f44eca2ed486592c473f97fd5cd0941edb9d216051802dad3f7_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:e3f56102b0cf46e862fc1e015516c5364e49d02cd6ca112b72b1fa3287a96a2d_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (9)