← Back to CVEs

CVE-2024-36129

HIGH

8.2

Description

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.

CVE Details

CVSS v3.1 Score8.2

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published6/5/2024

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

opentelemetry:configgrpcopentelemetry:confighttpopentelemetry:opentelemetry_collector

Weaknesses (CWE)

CWE-119CWE-119

References

https://github.com/open-telemetry/opentelemetry-collector/pull/10289(security-advisories@github.com)

https://github.com/open-telemetry/opentelemetry-collector/pull/10323(security-advisories@github.com)

https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v(security-advisories@github.com)

https://opentelemetry.io/blog/2024/cve-2024-36129(security-advisories@github.com)

https://github.com/open-telemetry/opentelemetry-collector/pull/10289(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/open-telemetry/opentelemetry-collector/pull/10323(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v(af854a3a-2127-422b-91ae-364da2661108)

https://opentelemetry.io/blog/2024/cve-2024-36129(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.