This security advisory covers the Red Hat build of OpenTelemetry version 3.6.1, which includes fixes for two vulnerabilities: CVE-2025-4673 and CVE-2025-6020. Both CVEs are associated with CWE-22, indicating path traversal issues. The update is provided as a security fix without additional changes or enhancements. The affected products include Red Hat OpenShift distributed tracing components and related container images across multiple architectures. No CVSS score is provided, and no known exploits have been reported. The vendor advisory confirms the availability of the updated version as the remediation.

The vulnerabilities fixed are classified as high severity and relate to path traversal (CWE-22), which can potentially allow unauthorized access to files or directories outside the intended scope. However, no known exploits in the wild have been reported. The impact is mitigated by applying the updated Red Hat build of OpenTelemetry 3.6.1, which addresses these issues.

A fixed version, Red Hat build of OpenTelemetry 3.6.1, is available and should be applied to affected systems. The vendor advisory provides instructions for upgrading via the OpenShift Operator Lifecycle Manager (OLM). No additional mitigations are indicated or required beyond applying this update. Patch status is confirmed by the vendor advisory.