The following advisory data is extracted from: https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_3621.json Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment. - Packet Storm Staff ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenShift distributed tracing 3.2.0 operator/operand containers update Advisory ID: RHSA-2024:3621-03 Product: Red Hat OpenShift distributed tracing Advisory URL: https://access.redhat.com/errata/RHSA-2024:3621 Issue date: 2024-06-05 Revision: 03 CVE Names: CVE-2023-45286 ==================================================================== Summary: Red Hat OpenShift distributed tracing 3.2.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description: Release of Red Hat OpenShift distributed tracing provides these changes: Security Fix(es): * go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2 (CVE-2023-45286) * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) * golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289) * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783) * golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784) * golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785) * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution: CVEs: CVE-2023-45286 References: https://access.redhat.com/security/updates/classification/#important https://bugzilla.redhat.com/show_bug.cgi?id=2252012 https://bugzilla.redhat.com/show_bug.cgi?id=2268017 https://bugzilla.redhat.com/show_bug.cgi?id=2268018 https://bugzilla.redhat.com/show_bug.cgi?id=2268019 https://bugzilla.redhat.com/show_bug.cgi?id=2268021 https://bugzilla.redhat.com/show_bug.cgi?id=2268022 https://bugzilla.redhat.com/show_bug.cgi?id=2268046 https://bugzilla.redhat.com/show_bug.cgi?id=2268273 https://issues.redhat.com/browse/TRACING-3139 https://issues.redhat.com/browse/TRACING-3599 https://issues.redhat.com/browse/TRACING-3693 https://issues.redhat.com/browse/TRACING-3725 https://issues.redhat.com/browse/TRACING-3738 https://issues.redhat.com/browse/TRACING-3761 https://issues.redhat.com/browse/TRACING-3764 https://issues.redhat.com/browse/TRACING-3801 https://issues.redhat.com/browse/TRACING-3834 https://issues.redhat.com/browse/TRACING-3836 https://issues.redhat.com/browse/TRACING-3856 https://issues.redhat.com/browse/TRACING-3884 https://issues.redhat.com/browse/TRACING-3919 https://issues.redhat.com/browse/TRACING-3920 https://issues.redhat.com/browse/TRACING-3921 https://issues.redhat.com/browse/TRACING-3935 https://issues.redhat.com/browse/TRACING-3936 https://issues.redhat.com/browse/TRACING-3946 https://issues.redhat.com/browse/TRACING-3959 https://issues.redhat.com/browse/TRACING-3961 https://issues.redhat.com/browse/TRACING-3964 https://issues.redhat.com/browse/TRACING-3965 https://issues.redhat.com/browse/TRACING-3966 https://issues.redhat.com/browse/TRACING-3967 https://issues.redhat.com/browse/TRACING-3968 https://issues.redhat.com/browse/TRACING-3969 https://issues.redhat.com/browse/TRACING-3970 https://issues.redhat.com/browse/TRACING-3971 https://issues.redhat.com/browse/TRACING-3972 https://issues.redhat.com/browse/TRACING-3973 https://issues.redhat.com/browse/TRACING-3974 https://issues.redhat.com/browse/TRACING-3981 https://issues.redhat.com/browse/TRACING-4007 https://issues.redhat.com/browse/TRACING-4009 https://issues.redhat.com/browse/TRACING-4061 https://issues.redhat.com/browse/TRACING-4065 https://issues.redhat.com/browse/TRACING-4068 https://issues.redhat.com/browse/TRACING-4072 https://issues.redhat.com/browse/TRACING-4078 https://issues.redhat.com/browse/TRACING-4087 https://issues.redhat.com/browse/TRACING-4127