GO-2024-2900
Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-36129
- Alias
- BIT-opentelemetry-collector-2024-36129, GHSA-c74f-6mfw-mm4v
Description
An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · go.opentelemetry.io/collector/config/configgrpc | introduced 0, fixed 0.102.1 |
| Go · go.opentelemetry.io/collector/config/confighttp | introduced 0, fixed 0.102.0 |
Références
- https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v ADVISORY
- https://github.com/open-telemetry/opentelemetry-collector/pull/10289 FIX
- https://github.com/open-telemetry/opentelemetry-collector/pull/10323 FIX
- https://opentelemetry.io/blog/2024/cve-2024-36129 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |