CVE-2023-47108

CVSS V2 None CVSS V3 None
Description
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.
Overview
  • CVE ID
  • CVE-2023-47108
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-11-10T18:31:33.730Z
  • Last Modified Date
  • 2023-11-10T18:31:33.730Z
Weakness Enumerations
CWE URL
CWE-770 http://cwe.mitre.org/data/definitions/770.html
References
Reference URL Reference Tags
https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322 x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333b x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327 x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/google.golang.org/grpc/otelgrpc/v0.45.0/instrumentation/google.golang.org/grpc/otelgrpc/config.go#L138 x_refsource_MISC
https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProvider x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-47108
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47108
History
Created Old Value New Value Data Type Notes
2024-06-25 09:43:07 Added to TrackCVE