RHSA-2025:3607HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.5.1 release

Published
April 4, 2025
Last Modified
September 17, 2026

🔗 CVE IDs covered (3)

CVE-2025-2842 →CVE-2025-30204 →CVE-2025-2786 →

📋 Description

CVE-2025-2786 — tempo-operator: ServiceAccount Token Exposure Leading to Token and Subject Access Reviews in OpenShift Tempo Operator CVE-2025-2842 — tempo-operator: Tempo Operator Token Exposition lead to read sensitive data CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

🎯 Affected products26

  • Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel8@sha256:2c10ff99cecd5a80f8cd59dfb74bf768bd3e8fc87616be30f2439ab1c1f32c3c_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel8@sha256:adba030ecb2f998e52a136ce0e1c2d36909888b89fe7d1e7c95b5da5d6f8e927_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel8@sha256:b4c535900eeae9ff1ce2d08f3fe8b819eed633431a2906859335889549883b99_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel8@sha256:d44758883d9bd4ce3246a92b71e81b72abf9051851d34aa4d98594951fd3082c_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-gateway-rhel8@sha256:133f4f1087b0e199f211007ceb2aeae9b9202c5961e812ea4aa037d375a93415_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-gateway-rhel8@sha256:630e24b5a39e415fbe48843ca18908634d55af2051a3f76dd538b6978f1e3669_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-gateway-rhel8@sha256:b6c27629f411b90f3a7e5b27732f250c7dfa57d75ee1636de644a4d40a65d228_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-gateway-rhel8@sha256:f98634834feb77a03d96abf8264ce3a433f44c5645b2623793fb5d0193d8cf84_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel8@sha256:692a0a623566b428ec580408ddca17c9f5cbfb5bfb4de7fe694889cc1bb58e9d_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel8@sha256:7ca83d25a1436f91241449b12e1fb67ebc7384329b2c7988d3271d3d35302c02_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel8@sha256:a3439dd373ac34a13a99510275007e9229e07cddc6fc6db09aa7f952adbfaa4c_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel8@sha256:ef4cfa8974700cb4fcff1ac31ee648fd733c9205bf3432f3b4e291838a6413d2_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:295309554800a4a1d5d0646c8ec776e2f712cd13cebb085078df5ba85d604808_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-query-rhel8@sha256:0e7b8b0a049d4e5468138d4578cdd051b13257f6cdf59c64319c4769bcce7597_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-query-rhel8@sha256:2483855a80e228e5cd2e02b10b7941417426838b1111c21c4e08e5166027aea9_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-query-rhel8@sha256:4a99b059bc5edc891b048822c9da5a654b163756e647ecd6da38b81fb5563222_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-query-rhel8@sha256:ebb8923f54cf129d88142a20a3936677dcb631b5e411b4e0782d6020e6682266_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-rhel8-operator@sha256:233132300a9f5f019047a414b240f5b32c7563af8107bb52c4395892fdcd0fe0_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-rhel8-operator@sha256:29c1be152c9b2ca9fa8af25a10f156f8731b8396e8b2bc82d6b398a5e5027fdf_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-rhel8-operator@sha256:a494025181bea65d1d839460a4a3985a46dc5f62cf7939b69293b95de5b1563a_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-rhel8-operator@sha256:cbe0df797c34aebfec911c281fbfee9fe7713a4c45d778ae480cd6a7bcab202e_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-rhel8@sha256:486d4627fa99b6b1002bb257f02c7c212ed5e65bf22e163ed96d542297bc753e_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-rhel8@sha256:97972d686b7df8acb5c859255f49d965a466dc9d445aa90f8aca3ac59d4d9e59_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-rhel8@sha256:c409c4b02e50e5f10e5da74f0692a194fb23db824aa49552c1e9ce76dbd74494_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.3
  • registry.redhat.io/rhosdt/tempo-rhel8@sha256:fceb29a4b587e61efdc89e5fc662b09767cc8750e86f17eaf3070b279b708899_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Workaround: Currently, no mitigation is available for this vulnerability. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (7)