Red Hat Security Advisory

RHSA-2025:3607

Red Hat OpenShift distributed tracing platform (Tempo) 3.5.1 release

Released 2025-04-04 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/tempo-gateway-rhel8, registry.redhat.io/rhosdt/tempo-rhel8-operator

Fixes 3 records

TI-2025-21540 CVE-2025-30204 · GHSA-mh63-6h87-95cp

jwt-go allows excessive memory allocation during header parsing

MEDIUM 40

golang-jwt is a Go implementation of JSON Web Tokens.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00811 Published 2025-03-21 Partial fix · 4.5.2, 5.2.2 CWE-405

TI-2025-02482 CVE-2025-2842 · GHSA-5xf3-gmx4-529v

Tempo-operator: tempo operator token exposition lead to read sensitive data

LOW 20

A flaw was found in the Tempo Operator.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00397 Published 2025-04-02 Partial fix · 0.15.3, rhosdt-3.5-1743162265 +2 CWE-200

TI-2025-02435 CVE-2025-2786 · GHSA-28gr-56hr-prp6

Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator

LOW 20

A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00376 Published 2025-04-02 Partial fix · 0.15.3, rhosdt-3.5-1743162265 +2 CWE-200