Malicious code in Be.Vlaandereո.Basisregistеrs.OpenTelemetry (NuGet)

--- -= Per source details. Do not edit below this line.=-...

GHSA-V6V8-XJ6M-XWQH vulnerabilities

Vulnerabilities for packages: cert-manager-fips, ksops, zarf, argo-events-fips, gh, crossplane-provider-azure-sql, flux-helm-controller, skopeo, keda-fips, vexctl, goreleaser, slsa-verifier, crossplane-provider-azure-storage, spire-server, flux, opentofu, fulcio-fips, argo-events, step-ca,...

GO-2024-2900 Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc

An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption...

OpenTelemetry Collector Installed (Linux / Unix)

Binary data opentelemetrynixinstalled.nbin...

OpenTelemetry Collector < 0.102.1 DoS

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

CVE-2024-36129

A flaw was found in OpenTelemetry Collector. When sending an HTTP or gRPC request with a compressed payload, the Collector only verifies whether the compressed payload is beyond a certain limit but not its uncompressed version. This flaw allows an attacker using a specially crafted HTTP or gRPC...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: cosign, argo-workflows, prometheus-operator, fluent-bit-plugin-loki, falcoctl, fulcio, wal-g, zarf, harbor-registry, flux-image-reflector-controller, spire-server, guac, rclone, policy-controller, step-ca, buildkitd, flyte, pulumi, thanos, sigstore-scaffolding, trino...

GHSA-87M9-RV8P-RGMG go-grpc-compression has a zstd decompression bombing vulnerability

Impact A malicious user could cause a denial of service DoS when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases. Versions v1.1.4 through to v1.2.2 made use of the Decoder.DecodeAll...

GHSA-87M9-RV8P-RGMG vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-fips, opentelemetry-collector-contrib, tempo-fips, datadog-agent-fips, datadog-agent, opentelemetry-collector-contrib-fips, spicedb, opentelemetry-collector, tempo...

GHSA-87M9-RV8P-RGMG vulnerabilities

Vulnerabilities for packages: tempo, opentelemetry-collector, spicedb, datadog-agent, opentelemetry-collector-contrib...

go-grpc-compression has a zstd decompression bombing vulnerability

Impact A malicious user could cause a denial of service DoS when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases. Versions v1.1.4 through to v1.2.2 made use of the Decoder.DecodeAll...

CVE-2024-36129 vulnerabilities

Vulnerabilities for packages: tempo, opentelemetry-collector-contrib, datadog-agent, opentelemetry-collector...

CVE-2024-36129 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-fips, opentelemetry-collector-contrib, tempo-fips, datadog-agent-fips, datadog-agent, opentelemetry-collector-contrib-fips, opentelemetry-collector, tempo...

CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

CVE-2024-36129

OpenTelemetry Collector is affected by CVE-2024-36129, an unsafe decompression vulnerability that allows unauthenticated remote DoS via excessive memory consumption. The issue affects the OpenTelemetry Collector and its modules, with fixes published in version 0.102.1 of the collector and 0.102.1...

CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

GHSA-C74F-6MFW-MM4V vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-fips, opentelemetry-collector-contrib, tempo-fips, datadog-agent-fips, datadog-agent, opentelemetry-collector-contrib-fips, opentelemetry-collector, tempo...

GHSA-C74F-6MFW-MM4V vulnerabilities

Vulnerabilities for packages: tempo, opentelemetry-collector-contrib, datadog-agent, opentelemetry-collector...

Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

Summary An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. Details The OpenTelemetry Collector handles compressed HTTP requests by recognizing the Content-Encoding header, rewriting the HTTP request body, and allowing...