rhsa-2025:10735
Vulnerability from csaf_redhat
Published
2025-07-09 14:31
Modified
2025-07-30 15:34
Summary
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.6.1 release

Notes

Topic
Red Hat build of OpenTelemetry 3.6.1 has been released
Details
This release of the Red Hat build of OpenTelemetry provides a CVE fix. Breaking changes: * Nothing Deprecations: * Nothing Technology Preview features: * Nothing Enhancements: * Nothing Bug fixes: * Nothing Known issues: * Nothing
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat build of OpenTelemetry 3.6.1 has been released",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of the Red Hat build of OpenTelemetry provides a CVE fix.\n\nBreaking changes:\n* Nothing\n\nDeprecations:\n* Nothing\n\nTechnology Preview features:\n* Nothing\n\nEnhancements:\n* Nothing\n\nBug fixes:\n* Nothing\n\nKnown issues:\n* Nothing",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:10735",
        "url": "https://access.redhat.com/errata/RHSA-2025:10735"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-4673",
        "url": "https://access.redhat.com/security/cve/CVE-2025-4673"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-6020",
        "url": "https://access.redhat.com/security/cve/CVE-2025-6020"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry",
        "url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10735.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.6.1 release",
    "tracking": {
      "current_release_date": "2025-07-30T15:34:12+00:00",
      "generator": {
        "date": "2025-07-30T15:34:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.5"
        }
      },
      "id": "RHSA-2025:10735",
      "initial_release_date": "2025-07-09T14:31:36+00:00",
      "revision_history": [
        {
          "date": "2025-07-09T14:31:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-07-09T14:31:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-30T15:34:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift distributed tracing 3.6.1",
                "product": {
                  "name": "Red Hat OpenShift distributed tracing 3.6.1",
                  "product_id": "Red Hat OpenShift distributed tracing 3.6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_distributed_tracing:3.6::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift distributed tracing"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-operator-bundle@sha256%3A4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752053203"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-collector-rhel8@sha256%3A93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046452"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-rhel8-operator@sha256%3Ac18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046437"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-target-allocator-rhel8@sha256%3A46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046439"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-collector-rhel8@sha256%3A77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046452"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-rhel8-operator@sha256%3A643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046437"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-target-allocator-rhel8@sha256%3Af49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046439"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-collector-rhel8@sha256%3A40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046452"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-rhel8-operator@sha256%3A39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046437"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-target-allocator-rhel8@sha256%3A18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046439"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-collector-rhel8@sha256%3A1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046452"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-rhel8-operator@sha256%3A5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046437"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-target-allocator-rhel8@sha256%3A281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=rhosdt-3.6-1752046439"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64 as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64 as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64 as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64 as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64 as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64 as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64 as a component of Red Hat OpenShift distributed tracing 3.6.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-4673",
      "discovery_date": "2025-06-18T06:34:57.662025+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2373305"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in net/http. Handling Proxy-Authorization and Proxy-Authenticate headers during cross-origin redirects allows these headers to be inadvertently forwarded, potentially exposing sensitive authentication credentials. This flaw allows a network-based attacker to manipulate redirect responses, unintentionally exposing authentication details to unauthorized parties.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: Sensitive headers not cleared on cross-origin redirect in net/http",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The issue is rated as Moderate because while it can lead to a significant compromise of confidentiality, the attack complexity is high. Successful exploitation requires a specific set of circumstances, including the use of a proxy that relies on these headers for authentication and a user being enticed to interact with a malicious URL. The vulnerability does not allow for arbitrary code execution or a direct compromise of system integrity or availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-4673"
        },
        {
          "category": "external",
          "summary": "RHBZ#2373305",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373305"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-4673",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-4673"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-4673",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4673"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/679257",
          "url": "https://go.dev/cl/679257"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/73816",
          "url": "https://go.dev/issue/73816"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A",
          "url": "https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3751",
          "url": "https://pkg.go.dev/vuln/GO-2025-3751"
        }
      ],
      "release_date": "2025-06-11T16:42:53.054000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-09T14:31:36+00:00",
          "details": "For details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:10735"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: Sensitive headers not cleared on cross-origin redirect in net/http"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Olivier BAL-PETRE"
          ],
          "organization": "ANSSI - French Cybersecurity Agency"
        }
      ],
      "cve": "CVE-2025-6020",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2025-06-12T16:33:01.214000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2372512"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "linux-pam: Linux-pam directory Traversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in pam_namespace marked as Important rather than Moderate due to its direct impact on privilege boundaries and the ease of exploitation in common configurations. By leveraging symlink attacks or race conditions in polyinstantiated directories under their control, unprivileged local users can escalate to root, compromising the entire system. Since pam_namespace is often used in multi-user environments (e.g., shared systems, terminal servers, containers), a misconfigured or partially protected setup becomes a single point of failure. The attack does not require special capabilities or kernel-level exploits\u2014just timing and control over certain paths\u2014making it both reliable and low-barrier. Moreover, privilege escalation flaws like this can be chained with other vulnerabilities to persist or evade detection, further amplifying the risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-6020"
        },
        {
          "category": "external",
          "summary": "RHBZ#2372512",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372512"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-6020",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-6020"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6020",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6020"
        }
      ],
      "release_date": "2025-06-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-09T14:31:36+00:00",
          "details": "For details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:10735"
        },
        {
          "category": "workaround",
          "details": "Disable the `pam_namespace` module if it is not essential for your environment, or carefully review and configure it to avoid operating on any directories or paths that can be influenced or controlled by unprivileged users, such as user home directories or world-writable locations like `/tmp`.",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:1faa5daf085b0844740653d96711b3fcfa766a77224fb523335d877b8e314b57_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:40535c017d2730645c57c44b32b4df1613585cc19c052fe472ccbf543a659c42_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:77dc762cbd33d65add35e10c141b1c5c7c3245dfee3e4d977be7ceeabeee7831_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:93a3f6c10968431079bf0b637b029406d6a0bdc9521f3a02b062af7a3539995e_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:4fb2fb1cda1b02adbd8e9ecb34a05e76aa45159d81244209cbb3c2013418bd17_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:39378c1e705973edca5f52f422b5c3693aaf5d2f22fb320d7676086b2cf846ba_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:5bb83d0b9387f51291c3977d37aab8a19e978a7dccf3d72cae0dabb66bd26df4_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:643b9297fe6bf515d142ad8c857d279aa47854aecd0c9cdb90061185ac78987a_arm64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c18d414518b1eaed33a17a13f6c0273ab14405dd9569c169e6839026330e0895_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:18ca3c44f6f25cbfe67842a0b2c9491a8247a64dbd166f188dccf0a84cfd3e67_ppc64le",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:281913677308b5a7f0f834161ca1c1cf22e2686616f60057ac8ae61627f66861_s390x",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:46090c79b193de2028b4c994d3013fec7102f3b10673ecd09b017be4de7bf9f6_amd64",
            "Red Hat OpenShift distributed tracing 3.6.1:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:f49a121a3d0ec81f510680cd47c552f82c48889f28d3f14037c582636085410a_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "linux-pam: Linux-pam directory Traversal"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.