REDHAT-BUG-2456252: High severity OpenTelemetry OpenTelemetry-Go vulnerability
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opentelemetry-goto a version that resolves this vulnerability.Fixed in 1.41.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2456252?
The severity of REDHAT-BUG-2456252 is high, rated at 7.
How do I fix REDHAT-BUG-2456252?
To fix REDHAT-BUG-2456252, upgrade OpenTelemetry-Go to version 1.41.0 or later.
What impact does REDHAT-BUG-2456252 have?
REDHAT-BUG-2456252 can lead to CPU and memory amplification attacks when multiple baggage header lines are sent.
What versions are affected by REDHAT-BUG-2456252?
REDHAT-BUG-2456252 affects OpenTelemetry-Go versions from 1.36.0 to 1.40.0.
Is REDHAT-BUG-2456252 an exploited vulnerability?
As of now, there are no known active exploits for REDHAT-BUG-2456252.