opentelemetry: DoS vulnerability in otelhttp

A memory leak was found in the otelhttp handler of open-telemetry. This flaw allows a remote, unauthenticated attacker to exhaust the server's memory by sending many malicious requests, affecting the availability...

RHEL 8 / 9 : Red Hat Ceph Storage 5.3 (RHSA-2024:4118)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4118 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage...

Malicious code in Be.Vlaanderen.Basisregisters.OpenTеlemetry.Elаstic.Apm (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4074 Malicious code in Be.Vlaanderen.Basisregіsters.OpenTеlemetrу.Elаstic.Apm (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaandereո.Basisregistеrs.OpenTelemetry (NuGet)

--- -= Per source details. Do not edit below this line.=-...

GHSA-V6V8-XJ6M-XWQH vulnerabilities

Vulnerabilities for packages: kubevela, flux-source-controller, flux, k3s, zarf, tekton-chains, flux-image-reflector-controller, crossplane-provider-azure-managedidentity, opentelemetry-collector-contrib, prometheus, terragrunt, actions-runner-controller-fips, policy-controller-fips, zot,...

GO-2024-2900 Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc

An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption...

OpenTelemetry Collector Installed (Linux / Unix)

Binary data opentelemetrynixinstalled.nbin...

OpenTelemetry Collector < 0.102.1 DoS

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

CVE-2024-36129

A flaw was found in OpenTelemetry Collector. When sending an HTTP or gRPC request with a compressed payload, the Collector only verifies whether the compressed payload is beyond a certain limit but not its uncompressed version. This flaw allows an attacker using a specially crafted HTTP or gRPC...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: trino, goreleaser, k8sgpt, flux-source-controller, kubescape, prometheus-operator, ksops, step-ca, chezmoi, py3-azure-identity, trivy, wal-g, opentelemetry-collector-contrib, pulumi, fulcio, flux, rekor, restic, flux-kustomize-controller, up, nuclei, harbor-registry,...

go-grpc-compression has a zstd decompression bombing vulnerability

Impact A malicious user could cause a denial of service DoS when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases. Versions v1.1.4 through to v1.2.2 made use of the Decoder.DecodeAll...

GHSA-87M9-RV8P-RGMG go-grpc-compression has a zstd decompression bombing vulnerability

Impact A malicious user could cause a denial of service DoS when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases. Versions v1.1.4 through to v1.2.2 made use of the Decoder.DecodeAll...

GHSA-87M9-RV8P-RGMG vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, spicedb, opentelemetry-collector-fips...

GHSA-87M9-RV8P-RGMG vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, opentelemetry-collector-contrib, spicedb...

CVE-2024-36129 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, opentelemetry-collector-contrib...

CVE-2024-36129 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib, opentelemetry-collector-fips...

CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

CVE-2024-36129

OpenTelemetry Collector is affected by CVE-2024-36129, an unsafe decompression vulnerability that allows unauthenticated remote DoS via excessive memory consumption. The issue affects the OpenTelemetry Collector and its modules, with fixes published in version 0.102.1 of the collector and 0.102.1...