CVE-2023-25151

CVE-2023-25151 affects opentelemetry-go-contrib's otelhttp (v0.38.0) where ServerRequest records http.target as the full request URI (including query string). This causes high cardinality of metrics (http.server.request_content_length, http.server.response_content_length, http.server.duration) an...

CVE-2023-25151 DoS vulnerability for high cardinality metrics in opentelemetry-go-contrib

opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp uses the httpconv.ServerRequest function to annotate metric measurements for the http.server.requestcontentlength,...

OpenTelemetry-Go Contrib 资源管理错误漏洞

OpenTelemetry-Go Contrib is a collection of extensions for OpenTelemetry Go in the OpenTelemetry open source. A resource management error vulnerability exists in OpenTelemetry-Go Contrib version v0.38.0, which stems from the fact that if the query string is always randomized, this results in an...

Uncontrolled Resource Consumption

opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp uses the httpconv.ServerRequest function to annotate metric measurements for the http.server.requestcontentlength,...

Uncontrolled Resource Consumption

opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp uses the httpconv.ServerRequest function to annotate metric measurements for the http.server.requestcontentlength,...

This Week in Spring - December 6th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? You know what Ive wanted to do? See my friends on the Spring team in person since the pandemic descended. And, Im overjoyed to relate, Ive just had the privilege of a nice meeting with several of them last night...

This Week in Spring - October 18th, 2022

Hi, Spring fans! Howre you doin? Im doin alright! Last week I was in Antwerp, Belgium, for the amazing Devoxx BE show. I did a presentation with my friend and hero James Ward on Spring and Kotlin that was voted third most-liked talk at a show with more than 250 speakers! That was a personal caree...

A Bootiful Podcast: Google mad scientist Josh Suereth on Observability with OpenTelemetry, building better build tools, and so much more

Hi, Spring fans! In this installment, Josh Long @starbuxman looks at the latest and greatest in Spring Boot 3 AOT, then talks to Googles Josh Suereth @jsuereth about observability with OpenTelemetry, building better build tools, and so much more. Want to learn more about Spring Boot and the wider...

PT-2022-28158 · Unknown · Opentelemetry-Go Contrib

Name of the Vulnerable Software and Affected Versions: opentelemetry-go-contrib versions 0.38.0 through 0.38.0 Description: The issue concerns a denial-of-service attack due to memory allocation increase when handling requests with constantly random query strings. The httpconv.ServerRequest...

Malicious code in azure-monitor-opentelemetry-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4105e451e06ab909d8a5420349c767fec791355572db7e3696eb80c244fb050 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opentelemetry-instrumentation-azure-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc696b261d62c4ba710dfcb144ebd204e3452a65dddf5385fca6012e46ded8d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5103 Malicious code in opentelemetry-instrumentation-azure-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc696b261d62c4ba710dfcb144ebd204e3452a65dddf5385fca6012e46ded8d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in monitor-opentelemetry-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 729620b347fffdb19db80ab7389b2228d0b739d11d68fc8bed393e29ed9dd745 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4689 Malicious code in monitor-opentelemetry-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 729620b347fffdb19db80ab7389b2228d0b739d11d68fc8bed393e29ed9dd745 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security update for caddy (moderate)

openSUSE Security Update: Security update for caddy Announcement ID: openSUSE-SU-2022:10007-1 Rating: moderate References: 1200279 Cross-References: CVE-2022-297182 Affected Products: openSUSE Backports SLE-15-SP4 An update that fixes one vulnerability is now available. Description: This update f...

OPENSUSE-SU-2022:10007-1 Security update for caddy

This update for caddy fixes the following issues: Update to version 2.5.1: Fixed regression in Unix socket admin endpoints. Fixed regression in caddy trust commands. Hash-based load balancing policies iphash, urihash, header, and cookie use an improved highest-random-weight HRW algorithm for...

PT-2022-7151 · Unknown +2 · Opentelemetry-Go Contrib +2

Name of the Vulnerable Software and Affected Versions: OpenTelemetry-Go Contrib versions prior to 0.44.0 Description: The issue is related to a denial-of-service attack that can cause memory exhaustion when handling requests with non-standard HTTP methods or User-Agents. The library internally us...