Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
OpenTelemetry Collector on Red Hat Systems Exposed to Security Risk
published 1 year ago
Summary
The OpenTelemetry Collector on Red Hat systems has been updated to address a security issue. If left unpatched, an attacker could potentially exploit this vulnerability to execute code on the system. Red Hat recommends updating the OpenTelemetry Collector to the latest version to mitigate this risk.
What to do
- Update redhat opentelemetry-collector to version 0:0.107.0-8.el9_6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:9::appstream | redhat | opentelemetry-collector |
< 0:0.107.0-8.el9_6 Fix: upgrade to 0:0.107.0-8.el9_6
|
Original advisory text
Red Hat Security Advisory: opentelemetry-collector security update
References
- https://access.redhat.com/errata/RHSA-2025:7407 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2347423 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2352914 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7407.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22868 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22868 Vendor Advisory
- https://go.dev/cl/652155 Third Party Advisory
- https://go.dev/issue/71490 Third Party Advisory
- https://pkg.go.dev/vuln/GO-2025-3488 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-27144 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-27144 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-27144 Vendor Advisory
- https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc... Third Party Advisory
- https://github.com/go-jose/go-jose/releases/tag/v4.0.5 Third Party Advisory
- https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-29786 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-29786 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-29786 Vendor Advisory
- https://github.com/expr-lang/expr/pull/762 Third Party Advisory
- https://github.com/expr-lang/expr/security/advisories/GHSA-93mq-9ffx-83m2 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-30204 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-30204 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-30204 Vendor Advisory
- https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c... Third Party Advisory
- https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp Third Party Advisory
- https://pkg.go.dev/vuln/GO-2025-3553 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published14 May 2025
Updated6 Mar 2026
First seen6 Mar 2026
Sources
RHSA-2025:7407 · OSV
Track software like this
Free during beta