RHSA-2024:0998 - Security Advisory

Topic

Red Hat OpenShift distributed tracing 3.1.0

Red Hat Product Security has rated this update as having a security impact of "Low". A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Release of Red Hat OpenShift distributed tracing provides these changes: OpenTelemetry: support for target allocator. Tempo: Monolithic CRD, alerting for span RED metrics, TraceQL support for gateway. OpenTelemetry version 0.93.0. Tempo 2.3.1, Jaeger 1.53.0.

Security Fix(es):

CVE-2023-26159 follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse()

Solution

Red Hat OpenShift distributed tracing Release

Affected Products

• Red Hat OpenShift distributed tracing 3 x86_64
• Red Hat OpenShift distributed tracing for Power, little endian 3 ppc64le
• Red Hat OpenShift distributed tracing for IBM Z and LinuxONE 3 s390x
• Red Hat OpenShift distributed tracing for ARM 3 aarch64

Fixes

• BZ - 2256413 - CVE-2023-26159 follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse()
• TRACING-3135 - Add TraceQL support to TempoStack Gateway
• TRACING-3573 - Alerting from RED metrics
• TRACING-3746 - Enable target allocator in the OpenTelemetry collector
• TRACING-3756 - detectAutoscalingVersion always picks autoscaling/v2beta2 instead of autoscaling/v2 if both APIs are available
• TRACING-3786 - ClusterRoleBinding tempo-redmetrics-cluster-monitoring-view is not created when monitorTab is enabled in TempoStack.
• TRACING-3787 - Create CRD for Tempo Monolithic Deployment
• TRACING-3808 - Fix OTELcol span RED documentation config
• TRACING-3810 - Take replicas into account when calculating resource allocation
• TRACING-3717 - [Tempo] Not able to scale querier.
• TRACING-3718 - [Tempo] Cannot scale queryFrontend component.
• TRACING-3719 - [Tempo] Cannot scale Compactor component.

CVEs

• CVE-2021-35937
• CVE-2021-35938
• CVE-2021-35939
• CVE-2023-3446
• CVE-2023-3817
• CVE-2023-5678
• CVE-2023-7104
• CVE-2023-26159
• CVE-2023-39615
• CVE-2023-48795
• CVE-2024-0553

References

• https://access.redhat.com/security/updates/classification/#low