PT-2023-27169 · Amazon · Amazon Simple Email Service+1

Rapphil · Published 2023-08-08 · Updated 2023-08-16 · CVE-2023-39951

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenTelemetry Java Instrumentation versions prior to 1.28.0

Description The issue is related to the instrumentation of Java applications using the AWS SDK v2 with Amazon Simple Email Service (SES) v1 API. When SES POST requests are instrumented, the query parameters of the request are inserted into the trace url.path field, leading to the HTTP body containing the email subject and message being present in the trace request URL metadata. This exposes the email content to unintended audiences.

Recommendations For OpenTelemetry Java Instrumentation versions prior to 1.28.0, update to version 1.28.0 or later to mitigate the issue. As a temporary workaround, consider restricting the instrumentation of AWS SDK v2 calls to SES's v1 SendEmail API until the update is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-39951

GHSA-HGHR-R469-GFQ6

Affected Products

Aws Sdk

Amazon Simple Email Service

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39951.json · Exploit
• 🔥 https://github.com/open-telemetry/opentelemetry-java-instrumentation/issues/8956 · Exploit
• https://github.com/open-telemetry/opentelemetry-java-instrumentation/security/advisories/GHSA-hghr-r469-gfq6 · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-java-instrumentation/pull/8931 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39951 · Security Note
• https://t.me/cvenotify/56088 · Telegram Post
• https://t.me/cvenotify/56033 · Telegram Post
• https://twitter.com/TechFishNews/status/1689093943542366208 · Twitter Post