RHSA-2025:3743HighCVSS 7.5

Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.5.1 release

Published
April 9, 2025
Last Modified
August 25, 2026

🔗 CVE IDs covered (4)

CVE-2025-22868 →CVE-2025-27144 →CVE-2025-29786 →CVE-2025-30204 →

📋 Description

CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-27144 — go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-29786 — github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

🎯 Affected products14

  • Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:2cd5fdc0d5efee8f9ced0cf8389c000c245ca5368098c5ce0bc2b6241ac6a455_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:360b97d5055aba77fb7cc5c029e910be7e7eb10672df530eca2c91346da2f2b0_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:b7f6e9442ee2ae2b7122a9732eaa11a85b1f0264e60963819c7e5150c1457740_s390x as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:ee623bfdf53c09ea32927c9350732f24f0a3371ee38272cdd08ae858d519fd32_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:ea3e5c6cc3342f0f0e9c4d8f6f4cc5ab278cd68fc6302737c533e7bdaa8ed12b_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:a4c600ccf3e69b940834012246bd35621d128cd21216262b4ec3e3cef2bf854e_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:a626628fa5d1f05087dca3e93256a8092d6242cf3836f97723469ad31c80b3dd_s390x as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:d08f64f2db187122a8318f9860c703b52cd79048dcac6ecada7b08e71c012763_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:f82500883874b1171f0dc2ccc8e56fbf6e553f9332ab4a2e2353c38efdf3a2b8_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:31fbb53b77ca584f6f4a2cb900f4b5f74b1edb32e79e574f15b8a323057b1a2a_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:5801d945ec9c0a96f5700b18690ab6b23afea6ea2badccb2bfec9f6200b1d19d_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:834e7a4232d92c3773aa869fe96f95440d571014d72c984c6fce389c95796362_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.2
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f725e98f51b14cc553877c7b07e67062fef5bb431bd10f2c36eba5418d86a76b_s390x as a component of Red Hat OpenShift distributed tracing 3.5.2

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters. Workaround: To mitigate this vulnerability, it is recommended to impose an input size restriction before parsing (i.e. validating or limiting the length of expression strings that the application will accept). Ensuring no unbounded-length expressions are fed into the parser will prevent the parser from constructing a very large AST and avoid the potential memory exhaustion issue. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (8)