PT-2023-9340 · Unknown+2 · Opentelemetry-Go Contrib+2
Pellared
·
Publicado
2023-11-10
·
Atualizado
2025-10-28
·
CVE-2023-47108
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
OpenTelemetry-Go Contrib versions prior to 0.46.0
Description
The issue is related to the grpc Unary Server Interceptor adding labels
net.peer.sock.addr and net.peer.sock.port with unbound cardinality, leading to potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests, causing a denial-of-service.Recommendations
For versions prior to 0.46.0, as a temporary workaround, consider using a view that removes the attributes
net.peer.sock.addr and net.peer.sock.port.
Alternatively, disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.
For a permanent solution, upgrade to version 0.46.0 or later, which contains a fix for this issue.Exploit
Correção
DoS
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Opentelemetry-Go Contrib
Red Os
Suse