← Zuruck zu CVEs

CVE-2024-36129

HIGH

8.2

Beschreibung

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.

CVE Details

CVSS v3.1 Bewertung8.2

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht6/5/2024

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

opentelemetry:configgrpcopentelemetry:confighttpopentelemetry:opentelemetry_collector

Schwachen (CWE)

CWE-119CWE-119

Referenzen

https://github.com/open-telemetry/opentelemetry-collector/pull/10289(security-advisories@github.com)

https://github.com/open-telemetry/opentelemetry-collector/pull/10323(security-advisories@github.com)

https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v(security-advisories@github.com)

https://opentelemetry.io/blog/2024/cve-2024-36129(security-advisories@github.com)

https://github.com/open-telemetry/opentelemetry-collector/pull/10289(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/open-telemetry/opentelemetry-collector/pull/10323(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v(af854a3a-2127-422b-91ae-364da2661108)

https://opentelemetry.io/blog/2024/cve-2024-36129(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.