- Vulnerability/
- RHSA-2025:3607
RHSA-2025:3607: Red Hat OpenShift distributed tracing platform (Tempo) 3.5.1 release
First published: Fri Apr 04 2025(Updated: )
Release of Red Hat OpenShift distributed tracing provides following security improvements, bug fixes, and new features.<br>The Red Hat OpenShift distributed tracing (Tempo) 3.5.1 is based on the open source link:<a href="https://grafana.com/oss/tempo/" target="_blank">https://grafana.com/oss/tempo/</a>[Grafana Tempo] release 2.7.1.<br>Breaking changes:<br><li> With this update, for a user to create or modify a TempoStack or TempoMonolithic CR with enabled multi-tenancy, the user must have permissions to create a TokenReview and SubjectAccessReview.</li> Deprecations:<br><li> Nothing</li> Technology Preview features:<br><li> Nothing</li> Enhancements:<br><li> Nothing</li> Bug fixes:<br><li> <a href="https://access.redhat.com/security/cve/CVE-2025-2786" target="_blank">https://access.redhat.com/security/cve/CVE-2025-2786</a></li> <li> <a href="https://access.redhat.com/security/cve/CVE-2025-2842" target="_blank">https://access.redhat.com/security/cve/CVE-2025-2842</a></li> Known issues:<br><li> Currently, when the OpenShift tenancy mode is enabled, the ServiceAccount of the gateway component of a TempoStack or TempoMonolithic instance requires the TokenReview and SubjectAccessReview permissions for authorization. Workaround: deploy the instance in a dedicated namespace, and carefully audit which users have permission to read the Secrets in this namespace.</li>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat OpenShift Tempo | ||
| Grafana Tempo |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2025-2786
- https://access.redhat.com/security/cve/CVE-2025-2842
- https://access.redhat.com/security/cve/CVE-2025-30204
- https://access.redhat.com/security/updates/classification/
- https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo
- https://access.redhat.com/errata/RHSA-2025:3607 (Advisory)
Frequently Asked Questions
What is the severity of RHSA-2025:3607?
RHSA-2025:3607 is classified as a moderate-level security advisory indicating important updates are necessary.
How do I fix RHSA-2025:3607?
To address RHSA-2025:3607, users should update to the latest version of Red Hat OpenShift Tempo and Grafana Tempo.
What vulnerabilities are addressed in RHSA-2025:3607?
RHSA-2025:3607 addresses multiple vulnerabilities including CVE-2025-2786, CVE-2025-2842, and CVE-2025-30204.
Who is affected by RHSA-2025:3607?
RHSA-2025:3607 affects users of Red Hat OpenShift Tempo and Grafana Tempo.
When was RHSA-2025:3607 released?
RHSA-2025:3607 was released to provide security improvements and bug fixes pertinent to various users.
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2025:3607
- agent/last-modified-date
- agent/source
- agent/type
- agent/references
- agent/description
- agent/first-publish-date
- agent/title
- agent/remedy
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat openshift tempo
- vendor/grafana
- canonical/grafana tempo