OpenTelemetry Collector < 0.108.0 Authentication Bypass

The OpenTelemetry Collector running on the remote host is prior to 0.108.0. It is, therefore, affected by a timing discrepancy vulnerability, outlined below: OpenTelemetry Collector module awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

Important: amazon-cloudwatch-agent

Issue Overview: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows...

Important: amazon-cloudwatch-agent

Issue Overview: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows...

GHSA-JFVP-7X6P-H2PV vulnerabilities

Vulnerabilities for packages: runc, neuvector-scanner, opentelemetry-collector-contrib, kubernetes, grype, ctop, docker, syft, k3s, buildah, podman, cadvisor, grafana-alloy, k8s-device-plugin...

CVE-2024-45310 vulnerabilities

Vulnerabilities for packages: runc, neuvector-scanner, opentelemetry-collector-contrib, kubernetes, grype, ctop, docker, syft, k3s, buildah, podman, cadvisor, grafana-alloy, k8s-device-plugin...

GO-2024-3102 OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver

OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver...

GHSA-PRF6-XJXH-P698 OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability

Summary OpenTelemetry Collector module awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key. OpenTelemetry Collector can be configured to receive CloudWatch metrics via an AWS Firehose Stream. Firehose sets the header X-Amz-Firehose-Access-Key with an...

CVE-2024-45043 OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability

The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

CVE-2024-45043 OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability

The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

CVE-2024-45043

CVE-2024-45043 – OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Affected component: OpenTelemetry Collector Contrib awsfirehosereceiver (alpha module). Issue: when configured to require an access key (X-Amz-Firehose-Access-Key), the receiver still accepts requests with no key...

OpenTelemetry Collector 安全漏洞

OpenTelemetry Collector is a software from the OpenTelemetry project for receiving, processing, and exporting telemetry data. A security vulnerability exists in OpenTelemetry Collector that originates from allowing unauthenticated remote requests...

OpenTelemetry Collector < 0.107.0 Timing Discrepancy

The OpenTelemetry Collector running on the remote host is prior to 0.107.0. It is, therefore, affected by a timing discrepancy vulnerability, outlined below: The bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of the received & configured...

GHSA-V23V-6JW2-98FQ vulnerabilities

Vulnerabilities for packages: k9s, melange, eksctl, up, kubescape, zot, kots, aactl, falcoctl, helm-operator, cosign, tkn, vcluster, flux-source-controller, buf, argo-workflows, crossplane, kubeflow-katib, bom, kargo, paranoia, docker-credential-gcr, vexctl, zarf, docker, syft, timoni, helm-push,...

The vulnerability of the confighttp and configgrpc modules in the data processing software for OpenTelemetry Collector allows a attacker to cause a service failure.

The vulnerability of the confighttp and configgrpc modules in the OpenTelemetry Collector data processing software arises from memory exhaustion resulting from operations exceeding the buffer limits. Exploiting this vulnerability allows a malicious actor to cause service failures by sending...

CVE-2024-36129

A flaw was found in OpenTelemetry Collector. When sending an HTTP or gRPC request with a compressed payload, the Collector only verifies whether the compressed payload is beyond a certain limit but not its uncompressed version. This flaw allows an attacker using a specially crafted HTTP or gRPC...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: rclone, py3-cassandra-medusa, up, kubescape, velero, zot, airflow, hugo, falcoctl, prometheus-operator, sigstore-scaffolding, cosign, tkn, cortex, boring-registry, sqlpad, wal-g, flux-source-controller, argo-workflows, fluent-bit-plugin-loki, flyte,...

GHSA-87M9-RV8P-RGMG vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector, spicedb, opentelemetry-collector-contrib, tempo-fips, tempo...

GHSA-87M9-RV8P-RGMG vulnerabilities

Vulnerabilities for packages: tempo, opentelemetry-collector-contrib, opentelemetry-collector, spicedb...

CVE-2024-36129 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector, opentelemetry-collector-contrib, tempo-fips, tempo...

CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...