GO-2023-2331
Denial of service in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
At a glance
- Published
- Updated
- CVE
- CVE-2023-47108
- Aliases
- GHSA-8pgv-569h-w5rw
Description
The grpc Unary Server Interceptor created by the otelgrpc package added the labels net.peer.sock.addr and net.peer.sock.port with unbounded cardinality. This can lead to the server's potential memory exhaustion when many malicious requests are sent. This leads to a denial-of-service.
Affected packages
| Package | Versions |
|---|---|
| Go · go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc | introduced 0.37.0, fixed 0.46.0 |
References
- https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw ADVISORY
- https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333b FIX
- https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322 FIX
- https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProvider WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |