RHSA-2024:10962HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release

Published
December 11, 2024
Last Modified
September 6, 2026

🔗 CVE IDs covered (9)

CVE-2024-21536 →CVE-2024-43796 →CVE-2024-43800 →CVE-2024-45296 →CVE-2024-45590 →CVE-2024-45811 →CVE-2024-45812 →CVE-2024-47068 →CVE-2024-43799 →

📋 Description

CVE-2024-21536 — http-proxy-middleware: Denial of Service CVE-2024-43796 — express: Improper Input Handling in Express Redirects CVE-2024-43799 — send: Code Execution Vulnerability in Send Library CVE-2024-43800 — serve-static: Improper Sanitization in serve-static CVE-2024-45296 — path-to-regexp: Backtracking regular expressions cause ReDoS CVE-2024-45590 — body-parser: Denial of Service Vulnerability in body-parser CVE-2024-45811 — vite: server.fs.deny is bypassed when using ?import&raw CVE-2024-45812 — vite: XSS via DOM Clobbering gadget found in vite bundled scripts CVE-2024-47068 — rollup: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

🎯 Affected products34

  • Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:2a199dfb119a0a9e23cfb6ad30f3715c9219bb8fa880a8a41977829d763a4ca5_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:3a719c39310ec4c664a3e49bf899f070e46be72b7594ce73d335c549b474146f_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:a7ae101cffca890f8665237b153e97b6dc1b3a6b672eaeccdbe4bfbd7aedce17_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:b541c30e0c0180612046cc31c639b219f6e9f4c7ae2e631b6f03404b7d55ee1d_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-all-in-one-rhel8@sha256:952f5a651c58cf3f86ded53cdd03649e3c7cb5c91199fd42bf2333e2ae48cce2_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-all-in-one-rhel8@sha256:b7bcd8d1986f24bc0996360cc6c5eff80d57b3802969740a44ce98484113c1c8_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-all-in-one-rhel8@sha256:ceab26a0939aeb7c4280ff8ff8c8607087838ef37a429e5f8d5f2fa663f5e4fa_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-all-in-one-rhel8@sha256:eebbda52e7853c58f638a0e9ac19f2523396358b92a08c026233b6a9b6e3eb38_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-collector-rhel8@sha256:00481eba92932c2e8dcff9c2e74414423a95cdf7e158a081ac9b6ce64e095053_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-collector-rhel8@sha256:0e8aefb95c5605a7b986c2765417118217962a69a803b38b0d5b5da9ee18ed7a_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-collector-rhel8@sha256:6a073cd60d81bff01283dd4cbf680cfc7a17aa42cd262ae5ad4460142a2b5ec0_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-collector-rhel8@sha256:bf43ff8bf24eaf6694abfe3ba0ad34223743ac80473a7284aeb6e30c8b6f7a09_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:43a162e333dc9d7b3d78102ea1ad0edfdc5f83eda53416c26c352f64ce03648e_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:6d2163a0d54b4ca742e2669a1cf6145abaf8681fe68bfaf7b0adf3e386979f5a_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:b0a964e6cfabcab6b24a7caaac935304ab00bf5aac4a2895bebd78dc8dcc93cc_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:c81395f94df15ee18eefd08b0b0e83cac7e7a266558a1458cfa769504c49a1c5_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-rollover-rhel8@sha256:60aecc2ebb419a5dd979e503b9475af9b1def1ca82fcd9d4b96a05bc3a0686d6_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-rollover-rhel8@sha256:8a85c82050ca4a430ebeabb6192debca6daee99d9baa0cf96b156790f0984d02_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-rollover-rhel8@sha256:fd196cb2a9c3780ca1de2a6974bd3c2042c09bebf8a5c5a27bf5e51140a14e33_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-es-rollover-rhel8@sha256:fed0a62dffeb3fc63a57c54b66194d1fb754cb89ec0d8aa0f9a303d3fc494857_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-ingester-rhel8@sha256:44d844bd4f1c83b7ee66645a8f0e3c71c5f3fa84ee62553058c15106d8782a69_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-ingester-rhel8@sha256:c254cbefa1a0d57fbd1a4925254de1d6568cafa6b26be59db1df38142ab2256c_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-ingester-rhel8@sha256:e537e8f52fe57bb5ec047054e7a5f7e26a96d5ac52b85623cf56c946c93032cf_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-ingester-rhel8@sha256:e8cc4fc4b0d5b3238a6441acd162d5e8bba35c51a1bab2f2ff87b812c5ded866_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-operator-bundle@sha256:44b22b250cdf29c29cf8c71941ea9ffd84c8bc7f4fddffafcd1b194a125d9028_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-query-rhel8@sha256:78b4c8cb7e68b33fbd0cfb502a2d4e3ca09eeb6168d525c80ae0a45775364952_arm64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-query-rhel8@sha256:8d0e9eb0894de1289dfa9556cf9411874df3111f3e84471256de6b2d75ecd829_amd64 as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-query-rhel8@sha256:e7814650195a4ce28137f26da766217ed09dc2d974146b73fefb50b3e3c63749_ppc64le as a component of Red Hat OpenShift distributed tracing 3.4
  • registry.redhat.io/rhosdt/jaeger-query-rhel8@sha256:fe5c0636b57f316157812488029f3346363031b3e216dbc82ed9897a2d1347ab_s390x as a component of Red Hat OpenShift distributed tracing 3.4
  • +4 more not shown

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/h tml/operators/administrator-tasks#olm-upgrading-operators Workaround: Red Hat Product Security does not have any mitigation recommendations at this time. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (12)