cve-2024-36129
Vulnerability from cvelistv5
Published
2024-06-05 17:26
Modified
2024-08-02 03:30
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Summary
OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC
References
security-advisories@github.comhttps://github.com/open-telemetry/opentelemetry-collector/pull/10289Patch
security-advisories@github.comhttps://github.com/open-telemetry/opentelemetry-collector/pull/10323Patch
security-advisories@github.comhttps://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4vExploit, Third Party Advisory
security-advisories@github.comhttps://opentelemetry.io/blog/2024/cve-2024-36129Vendor Advisory
Impacted products
open-telemetryopentelemetry-collector
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "opentelemetry",
            "vendor": "opentelemetry",
            "versions": [
              {
                "lessThan": "0.102.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36129",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-19T12:31:23.085235Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T15:38:47.454Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:13.165Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v"
          },
          {
            "name": "https://github.com/open-telemetry/opentelemetry-collector/pull/10289",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-collector/pull/10289"
          },
          {
            "name": "https://github.com/open-telemetry/opentelemetry-collector/pull/10323",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-collector/pull/10323"
          },
          {
            "name": "https://opentelemetry.io/blog/2024/cve-2024-36129",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://opentelemetry.io/blog/2024/cve-2024-36129"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "opentelemetry-collector",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.102.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue.  It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-05T17:26:13.903Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-collector/pull/10289",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-collector/pull/10289"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-collector/pull/10323",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-collector/pull/10323"
        },
        {
          "name": "https://opentelemetry.io/blog/2024/cve-2024-36129",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://opentelemetry.io/blog/2024/cve-2024-36129"
        }
      ],
      "source": {
        "advisory": "GHSA-c74f-6mfw-mm4v",
        "discovery": "UNKNOWN"
      },
      "title": "OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-36129",
    "datePublished": "2024-06-05T17:26:13.903Z",
    "dateReserved": "2024-05-20T21:07:48.190Z",
    "dateUpdated": "2024-08-02T03:30:13.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36129\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-06-05T18:15:10.833\",\"lastModified\":\"2024-06-18T17:34:11.873\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue.  It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.\\n\"},{\"lang\":\"es\",\"value\":\"OpenTelemetry Collector ofrece una implementaci\u00f3n independiente del proveedor sobre c\u00f3mo recibir, procesar y exportar datos de telemetr\u00eda. Una vulnerabilidad de descompresi\u00f3n insegura permite a atacantes no autenticados bloquear el recopilador mediante un consumo excesivo de memoria. La versi\u00f3n 0.102.1 de OTel Collector soluciona este problema. Tambi\u00e9n est\u00e1 corregido en la versi\u00f3n 0.102.0 del m\u00f3dulo confighttp y en la versi\u00f3n 0.102.1 del m\u00f3dulo configgrpc.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opentelemetry:configgrpc:*:*:*:*:*:go:*:*\",\"versionEndExcluding\":\"0.102.1\",\"matchCriteriaId\":\"327CE873-41EC-401C-AF22-0A179C4A37D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opentelemetry:confighttp:*:*:*:*:*:go:*:*\",\"versionEndExcluding\":\"0.102.0\",\"matchCriteriaId\":\"13F55EF7-B8F7-4344-BE0C-C8129E57A306\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opentelemetry:opentelemetry_collector:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.102.1\",\"matchCriteriaId\":\"8F3C518A-75AF-4A34-83DF-9FCB346FE5EF\"}]}]}],\"references\":[{\"url\":\"https://github.com/open-telemetry/opentelemetry-collector/pull/10289\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/open-telemetry/opentelemetry-collector/pull/10323\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://opentelemetry.io/blog/2024/cve-2024-36129\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.