281 matches found
CVE-2024-45043 OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability
The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...
CVE-2024-45043 OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability
The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...
CVE-2024-45043
CVE-2024-45043 – OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Affected component: OpenTelemetry Collector Contrib awsfirehosereceiver (alpha module). Issue: when configured to require an access key (X-Amz-Firehose-Access-Key), the receiver still accepts requests with no key...
OpenTelemetry Collector 安全漏洞
OpenTelemetry Collector is a software from the OpenTelemetry project for receiving, processing, and exporting telemetry data. A security vulnerability exists in OpenTelemetry Collector that originates from allowing unauthenticated remote requests...
OpenTelemetry Collector < 0.107.0 Timing Discrepancy
The OpenTelemetry Collector running on the remote host is prior to 0.107.0. It is, therefore, affected by a timing discrepancy vulnerability, outlined below: The bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of the received & configured...
GHSA-V23V-6JW2-98FQ vulnerabilities
Vulnerabilities for packages: docker, harbor-scanner-trivy, flux, gh, kots, kaniko, scorecard, cadvisor, opentelemetry-collector-contrib, kargo, zarf, flux-image-reflector-controller, crossplane, apko, nerdctl, grafana-alloy, kpt, tkn, buildah, skaffold, cosign, guac, kubeflow-katib, gitsign, zot...
The vulnerability of the confighttp and configgrpc modules in the data processing software for OpenTelemetry Collector allows a attacker to cause a service failure.
The vulnerability of the confighttp and configgrpc modules in the OpenTelemetry Collector data processing software arises from memory exhaustion resulting from operations exceeding the buffer limits. Exploiting this vulnerability allows a malicious actor to cause service failures by sending...
CVE-2024-36129
A flaw was found in OpenTelemetry Collector. When sending an HTTP or gRPC request with a compressed payload, the Collector only verifies whether the compressed payload is beyond a certain limit but not its uncompressed version. This flaw allows an attacker using a specially crafted HTTP or gRPC...
CVE-2024-35255 vulnerabilities
Vulnerabilities for packages: prometheus-operator, hugo, flux, sigstore-scaffolding, trino, ksops, rekor, step-ca, opentelemetry-collector-contrib, py3-cassandra-medusa, zarf, flux-image-reflector-controller, tkn, airflow, grafana-mimir, cosign, guac, zot, boring-registry, restic,...
GHSA-87M9-RV8P-RGMG vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib-fips, tempo, spicedb, opentelemetry-collector-fips, opentelemetry-collector-contrib, opentelemetry-collector...
GHSA-87M9-RV8P-RGMG vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, opentelemetry-collector, tempo, spicedb...
CVE-2024-36129 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib-fips, tempo, opentelemetry-collector-fips, opentelemetry-collector-contrib, opentelemetry-collector...
CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC
The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...
CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC
The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...
CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC
The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...
CVE-2024-36129
OpenTelemetry Collector is affected by CVE-2024-36129, an unsafe decompression vulnerability that allows unauthenticated remote DoS via excessive memory consumption. The issue affects the OpenTelemetry Collector and its modules, with fixes published in version 0.102.1 of the collector and 0.102.1...
Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC
Summary An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. Details The OpenTelemetry Collector handles compressed HTTP requests by recognizing the Content-Encoding header, rewriting the HTTP request body, and allowing...
OpenTelemetry Collector Buffer Error Vulnerability
OpenTelemetry Collector is a software from the OpenTelemetry project for receiving, processing, and exporting telemetry data. A security vulnerability exists in OpenTelemetry Collector that stems from the presence of an insecure unpacking vulnerability that allows an unauthenticated attacker to...
PT-2024-4606
Name of the Vulnerable Software and Affected Versions: OpenTelemetry Collector versions prior to 0.102.1 confighttp module versions prior to 0.102.0 configgrpc module versions prior to 0.102.1 Description: An unsafe decompression vulnerability allows unauthenticated attackers to crash the collect...