Red Hat Security AdvisoryRHSA-2025:2789
Red Hat build of OpenTelemetry 3.5.0 release
Released 2025-03-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/opentelemetry-collector-rhel8, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8
Fixes 5 records
Priority MEDIUM 45
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01178 · Published 2025-02-18 · Partial fix · 2.12.10, 2.13.6 CWE-416
Priority LOW 36
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c.
CVSS 3.1HIGH 7.8· Local · No auth · No interaction · EPSS 0.00385 · Published 2025-02-18 · Partial fix · 2.12.10, 2.13.6 CWE-121
Priority LOW 32
In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00507 · Published 2026-01-16 · Partial fix · 1.22 CWE-190
Priority LOW 28
The HTTP client drops sensitive headers after following a cross-domain redirect.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0071 · Published 2025-01-28 · Partial fix · 1.22.11, 1.23.5 +1
Priority LOW 19
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture.
CVSS 3.1MEDIUM 4.0· Local · No auth · No interaction · EPSS 0.0029 · Published 2025-02-06 · Partial fix · 1.22.12, 1.23.6 +1
THREATIST.IORead the docs