Find, fix and prevent vulnerabilities in your code.

Overview

@opentelemetry/exporter-prometheus is an OpenTelemetry Exporter Prometheus provides a metrics endpoint for Prometheus

Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the PrometheusExporter process. An attacker can cause the process to terminate unexpectedly by sending a single malformed HTTP request to the metrics endpoint, resulting in an uncaught exception and process crash.

Note:

This is only exploitable if the application uses the built-in Prometheus exporter server or is configured with the OTEL_METRICS_EXPORTER environment variable including prometheus in combination with either @opentelemetry/sdk-node or @opentelemetry/auto-instrumentations-node.

Workaround

This vulnerability can be mitigated by restricting access to the metrics endpoint using network policies, binding the server to localhost, or placing the endpoint behind a reverse proxy that filters incoming requests.

Remediation

Upgrade @opentelemetry/exporter-prometheus to version 0.217.0 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

@opentelemetry/propagator-jaeger is an OpenTelemetry Jaeger propagator provides HTTP header propagation for systems that are using Jaeger HTTP header format.

Affected versions of this package are vulnerable to Uncaught Exception via the JaegerPropagator class when handling incoming HTTP headers. An attacker can cause the application to terminate unexpectedly by sending a specially crafted malformed percent-encoded value that triggers an unhandled exception.

Remediation

Upgrade @opentelemetry/propagator-jaeger to version 2.9.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

@opentelemetry/core is an OpenTelemetry Core provides constants and utilities shared by all OpenTelemetry SDK packages.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the extract function. An attacker can cause excessive memory allocation by sending oversized baggage HTTP headers or equivalent data via non-HTTP transports.

Note: This is only exploitable if the deployment does not enforce transport-layer header size limits, such as when using custom transports or when default HTTP header size limits are increased.

Workaround

This vulnerability can be mitigated by configuring strict header size limits at the server or gateway level, or by validating input size before passing it to the propagator in non-HTTP transports.

Remediation

Upgrade @opentelemetry/core to version 2.8.0 or higher.

References

• GitHub Advisory
• GitHub Commit