otelgrpc DoS vulnerability due to unbound cardinality metrics

🗓️ 12 Nov 2023 00:00:00Reported by https://gitlab.com/gitlab-org/security-products/gemnasium-dbType

gitlab

gitlab🔗 gitlab.com👁 67 Views

otelgrpc DoS vulnerability in OpenTelemetry-Go Contrib grpc Unary Server Interceptor prior to v0.46.

Reporter	Title	Published	Views	Family All 211
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	15 Apr 202502:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Allocation of Resources Without Limits or Throttling in Grafana (CVE-2023-47108)	7 Jul 202517:07	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of OpenTelemetry gRPC, IBM CICS TX Standard is vulnerable to an Denial of Service vulnerability (CVE-2023-47108).	11 Mar 202414:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to denial of service due to OpenTelemetry go module ( CVE-2023-45142, CVE-2023-47108 )	20 Mar 202417:49	–	ibm
Tenable Nessus	Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2024-498)	23 Jan 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2024-499)	23 Jan 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2024-697)	6 Aug 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2024-2424)	23 Jan 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2 : containerd (ALASDOCKER-2024-037)	6 Feb 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2 : containerd (ALASDOCKER-2024-041)	17 Aug 202400:00	–	nessus

Vulners

Node

go otelgrpcRange<0.46.0

Source	Link
github	www.github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-47108
github	www.github.com/open-telemetry/opentelemetry-go-contrib/pull/4322
github	www.github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333b
github	www.github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go
github	www.github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/google.golang.org/grpc/otelgrpc/v0.45.0/instrumentation/google.golang.org/grpc/otelgrpc/config.go
pkg	www.pkg.go.dev/go.opentelemetry.io/otel/metric/noop
github	www.github.com/advisories/GHSA-8pgv-569h-w5rw

12 Nov 2023 00:00Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.01592

SSVC

opentelemetry-go contrib dos vulnerability unary server interceptor unbound cardinality grpc memory exhaustion malicious requests fix workaround metrics instrumentation software