Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS01cjVtLTY1Z3gtN3ZyaM4AAxfv
otelhttp and otelbeego have DoS vulnerability for high cardinality metrics
Impact
The v0.38.0 release of go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
uses the httpconv.ServerRequest
function to annotate metric measurements for the http.server.request_content_length
, http.server.response_content_length
, and http.server.duration
instruments.
The ServerRequest
function sets the http.target
attribute value to be the whole request URI (including the query string)^1. The metric instruments do not "forget" previous measurement attributes when cumulative
temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack.
Pseudo-attack:
for infinite loop {
r := generate_random_string()
do_http_request("/some/path?random="+r)
}
Patches
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
- v0.39.0go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego
- v0.39.0
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01cjVtLTY1Z3gtN3ZyaM4AAxfv
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: 11 months ago
CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Identifiers: GHSA-5r5m-65gx-7vrh, CVE-2023-25151
References:
- https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh
- https://nvd.nist.gov/vuln/detail/CVE-2023-25151
- https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159
- https://github.com/advisories/GHSA-5r5m-65gx-7vrh
Blast Radius: 31.4
Affected Packages
go:go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego
Dependent packages: 8Dependent repositories: 25
Downloads:
Affected Version Ranges: >= 0.38.0, < 0.39.0
Fixed in: 0.39.0
All affected versions: 0.38.0
All unaffected versions: 0.12.0, 0.13.0, 0.14.0, 0.15.0, 0.15.1, 0.16.0, 0.17.0, 0.18.0, 0.19.0, 0.20.0, 0.21.0, 0.22.0, 0.23.0, 0.24.0, 0.25.0, 0.26.0, 0.26.1, 0.27.0, 0.28.0, 0.29.0, 0.30.0, 0.31.0, 0.32.0, 0.33.0, 0.34.0, 0.35.0, 0.36.0, 0.36.1, 0.36.2, 0.36.3, 0.36.4, 0.37.0, 0.39.0, 0.40.0, 0.41.0, 0.41.1, 0.42.0, 0.43.0
go:go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
Dependent packages: 3,287Dependent repositories: 15,269
Downloads:
Affected Version Ranges: >= 0.38.0, < 0.39.0
Fixed in: 0.39.0
All affected versions: 0.38.0
All unaffected versions: 0.12.0, 0.13.0, 0.14.0, 0.15.0, 0.15.1, 0.16.0, 0.17.0, 0.18.0, 0.19.0, 0.20.0, 0.21.0, 0.22.0, 0.23.0, 0.24.0, 0.25.0, 0.26.0, 0.26.1, 0.27.0, 0.28.0, 0.29.0, 0.30.0, 0.31.0, 0.32.0, 0.33.0, 0.34.0, 0.35.0, 0.35.1, 0.36.0, 0.36.1, 0.36.2, 0.36.3, 0.36.4, 0.37.0, 0.39.0, 0.40.0, 0.41.0, 0.41.1, 0.42.0, 0.43.0, 0.44.0, 0.45.0, 0.46.0, 0.46.1, 0.47.0, 0.48.0, 0.49.0