Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
gitlabHttps://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-56FE757B6BB87F340A3E0E0BBD0590DD
HistoryNov 12, 2023 - 12:00 a.m.

otelgrpc DoS vulnerability due to unbound cardinality metrics

2023-11-1200:00:00
https://gitlab.com/gitlab-org/security-products/gemnasium-db
gitlab.com
29
opentelemetry-go contrib
dos vulnerability
unary server interceptor
unbound cardinality
grpc
memory exhaustion
malicious requests
fix
workaround
metrics instrumentation
software

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7

Confidence

High

EPSS

0.001

Percentile

37.8%

JSON

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the server’s potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

Affected configurations

Vulners
Node
gootelgrpcRange<0.46.0
VendorProductVersionCPE
gootelgrpc*cpe:2.3:a:go:otelgrpc:*:*:*:*:*:*:*:*

Related

prion 1
osv 48
nessus 18
vulnrichment 1
f5 1
redhat 28
ubuntucve 1
cbl_mariner 8
github 1
cgr 1
ibm 3
redhatcve 1
cvelist 1
nvd 1
cve 1
wolfi 1
veracode 1
redos 1
openvas 2
amazon 1
prion
prion
Code injection
2023-11-10 19:15:00
osv
osv
CGA-j7wv-5m2f-gwvg
2024-06-06 12:28:05
CGA-mpvf-vpc6-gqrj
2024-06-06 12:28:33
CGA-2f62-c37v-36ch
2024-06-06 12:20:56
nessus
nessus
RHEL 8 : OpenShift Container Platform 4.12.48 (RHSA-2024:0489)
2024-01-31 00:00:00
RHEL 8 / 9 : OpenShift Container Platform 4.13.30 (RHSA-2024:0288)
2024-04-28 00:00:00
CBL Mariner 2.0 Security Update: docker-compose / docker-buildx / moby-containerd-cc / ig / containerd (CVE-2023-47108)
2024-07-03 00:00:00
vulnrichment
vulnrichment
CVE-2023-47108 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics
2023-11-10 18:31:33
f5
f5
K000138255 : Go OpenTelemetry Contrib vulnerability CVE-2023-47108
2024-01-16 00:00:00
redhat
redhat
(RHSA-2024:0489) Moderate: OpenShift Container Platform 4.12.48 packages and security update
2024-01-31 16:26:47
(RHSA-2024:0288) Moderate: OpenShift Container Platform 4.13.30 security update
2024-01-24 05:58:16
(RHSA-2024:0207) Moderate: OpenShift Container Platform 4.14.9 packages and security update
2024-01-17 16:41:29
ubuntucve
ubuntucve
CVE-2023-47108
2023-11-10 00:00:00
cbl_mariner
cbl_mariner
CVE-2023-47108 affecting package moby-containerd-cc for versions less than 1.7.2-3
2024-01-14 22:46:30
CVE-2023-47108 affecting package ig for versions less than 0.30.0-1
2024-07-23 02:21:02
CVE-2023-47108 affecting package docker-compose for versions less than 2.27.0-1
2024-05-17 21:38:35
github
github
otelgrpc DoS vulnerability due to unbound cardinality metrics
2023-11-12 15:55:39
cgr
cgr
CVE-2023-47108 vulnerabilities
2024-05-19 03:07:16
ibm
ibm
Security Bulletin: Due to the use of OpenTelemetry gRPC, IBM CICS TX Standard is vulnerable to an Denial of Service vulnerability (CVE-2023-47108).
2024-03-11 14:37:52
Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to denial of service due to OpenTelemetry go module ( CVE-2023-45142, CVE-2023-47108 )
2024-03-20 17:49:09
Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
2024-08-13 10:03:51
redhatcve
redhatcve
CVE-2023-47108
2023-11-23 12:21:08
cvelist
cvelist
CVE-2023-47108 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics
2023-11-10 18:31:33
nvd
nvd
CVE-2023-47108
2023-11-10 19:15:16
cve
cve
CVE-2023-47108
2023-11-10 19:15:16
wolfi
wolfi
CVE-2023-47108 vulnerabilities
2024-10-01 21:13:23
veracode
veracode
Denial Of Service
2023-11-13 11:23:08
redos
redos
ROS-20240826-13
2024-08-26 00:00:00
openvas
openvas
openSUSE: Security Advisory for containerd (SUSE-SU-2024:3221-1)
2024-09-13 00:00:00
SUSE: Security Advisory (SUSE-SU-2024:3221-1)
2024-09-12 00:00:00
amazon
amazon
Important: amazon-cloudwatch-agent
2024-01-19 01:51:00

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7

Confidence

High

EPSS

0.001

Percentile

37.8%

JSON
Related for GITLAB-56FE757B6BB87F340A3E0E0BBD0590DD
prion1osv48nessus18vulnrichment1f51redhat28ubuntucve1cbl_mariner8github1cgr1ibm3redhatcve1cvelist1nvd1cve1wolfi1veracode1redos1openvas2amazon1