GO-2024-3102 OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver

OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver...

GHSA-PRF6-XJXH-P698 OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability

Summary OpenTelemetry Collector module awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key. OpenTelemetry Collector can be configured to receive CloudWatch metrics via an AWS Firehose Stream. Firehose sets the header X-Amz-Firehose-Access-Key with an...

CVE-2024-45043

CVE-2024-45043 – OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Affected component: OpenTelemetry Collector Contrib awsfirehosereceiver (alpha module). Issue: when configured to require an access key (X-Amz-Firehose-Access-Key), the receiver still accepts requests with no key...

CVE-2024-45043

The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. "awsfirehosereceiver" allows unauthenticated remote requests, even when configured to require a key...

CVE-2024-45043 OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability

The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

CVE-2024-45043 OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability

The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

CVE-2024-45043: Exposure of Sensitive Information to an Unauthorized Actor

The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

OpenTelemetry Collector security vulnerabilities

OpenTelemetry Collector is a software from the OpenTelemetry project for receiving, processing, and exporting telemetry data. A security vulnerability exists in OpenTelemetry Collector that originates from allowing unauthenticated remote requests...

OpenTelemetry Collector < 0.107.0 Timing Discrepancy

The OpenTelemetry Collector running on the remote host is prior to 0.107.0. It is, therefore, affected by a timing discrepancy vulnerability, outlined below: The bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of the received & configured...

GHSA-V23V-6JW2-98FQ vulnerabilities

Vulnerabilities for packages: dive, kaniko, docker-credential-gcr, grype, cert-manager-cmctl, ko, timoni, buildah, newrelic-infrastructure-agent, flux, kpt, kubescape, eksctl, flux-helm-controller, paranoia, tkn, gitsign, policy-controller, goreleaser, syft, trivy, harbor-scanner-trivy, aactl, gh...

OpenTelemetry Collector confighttp configgrpc DoS

The vulnerability of the confighttp and configgrpc modules in the OpenTelemetry Collector data processing software arises from memory exhaustion resulting from operations exceeding the buffer limits. Exploiting this vulnerability allows a malicious actor to cause service failures by sending...

CVE-2024-36129

A flaw was found in OpenTelemetry Collector. When sending an HTTP or gRPC request with a compressed payload, the Collector only verifies whether the compressed payload is beyond a certain limit but not its uncompressed version. This flaw allows an attacker using a specially crafted HTTP or gRPC...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, flux-kustomize-controller, nuclei, flux, argo-events, cortex, kubescape, timestamp-authority, grafana-agent-operator, secrets-store-csi-driver-provider-azure, tkn, trivy, policy-controller, goreleaser, step, harbor-registry, sops, hugo-extended,...

GHSA-87M9-RV8P-RGMG vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, opentelemetry-collector, spicedb...

GHSA-87M9-RV8P-RGMG vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib, opentelemetry-collector-fips, spicedb, opentelemetry-collector...

CVE-2024-36129 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, opentelemetry-collector-fips, opentelemetry-collector, opentelemetry-collector-contrib-fips...

CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

CVE-2024-36129

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...