PT-2022-28158 · Unknown · Opentelemetry-Go Contrib

Aneurysm9 · Published 2022-07-15 · Updated 2023-10-16 · CVE-2023-25151

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions opentelemetry-go-contrib versions 0.38.0 through 0.38.0

Description The issue concerns a denial-of-service attack due to memory allocation increase when handling requests with constantly random query strings. The httpconv.ServerRequest function sets the http.target attribute value to the whole request URI, including the query string. When cumulative temporality is used, the metric instruments do not forget previous measurement attributes, resulting in a direct correlation between the cardinality of measurements allocated and unique URIs handled. This can lead to a constant increase in memory allocation, potentially causing a denial-of-service attack.

Recommendations For opentelemetry-go-contrib version 0.38.0, upgrade to version 0.39.0 to address the issue. There are no known workarounds for this issue.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-25151

GHSA-5R5M-65GX-7VRH

GO-2022-0322

GO-2023-1546

GO-2023-2113

Affected Products

Opentelemetry-Go Contrib

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25151.json · Exploit
• 🔥 https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh · Exploit
• https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5r5m-65gx-7vrh · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1546 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-25151 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0322 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2113 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25151 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-25151 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25151 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-25151 · Security Note
• https://github.com/prometheus/client_golang/pull/962 · Note
• https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmr · Note
• https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277 · Note