what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 8 of 8 RSS Feed

CVE-2023-45142

Status Candidate

Overview

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

Related Files

Red Hat Security Advisory 2024-6811-03
Posted Sep 25, 2024
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2024-6811-03 - Red Hat OpenShift Container Platform release 4.13.51 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service
systems | linux, redhat
advisories | CVE-2023-45142
SHA-256 | 2ce2a9e083a344acd2e91662f8716d1116572905f7af4b8b39c7702dfbcf5ac2
Download | Favorite | View
Red Hat Security Advisory 2024-6406-03
Posted Sep 12, 2024
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2024-6406-03 - Red Hat OpenShift Container Platform release 4.14.36 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service
systems | linux, redhat
advisories | CVE-2023-45142
SHA-256 | 9e89269f5e64f8231fa73bd6518d18b239c4099c255834ab2f77a0eaf92478ad
Download | Favorite | View
Red Hat Security Advisory 2024-6236-03
Posted Sep 4, 2024
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2024-6236-03 - Red Hat Advanced Cluster Management for Kubernetes 2.10.5 is now available. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service
systems | linux, redhat
advisories | CVE-2023-45142
SHA-256 | 627f83b7f4e8628de0af90ec17f6ddb89bf2dc315339eb9958695857e5b54198
Download | Favorite | View
Red Hat Security Advisory 2024-5433-03
Posted Aug 22, 2024
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2024-5433-03 - Red Hat OpenShift Container Platform release 4.14.35 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include denial of service and memory exhaustion vulnerabilities.

tags | advisory, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2023-45142
SHA-256 | 12ef67d1bad4f8e2a034c4535b044e05c6814ba2571f105f214c186a3d7d209c
Download | Favorite | View
Red Hat Security Advisory 2024-1328-03
Posted Mar 15, 2024
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2024-1328-03 - Red Hat Advanced Cluster Management for Kubernetes 2.9.3 General Availability release images, which fix bugs and update container images. Issues addressed include denial of service and traversal vulnerabilities.

tags | advisory, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2023-45142
SHA-256 | f6f85471c9a907c483cc77c26bf19a3950c25f78d7dd2e8e2bad198d0735c06b
Download | Favorite | View
Red Hat Security Advisory 2024-0641-03
Posted Feb 8, 2024
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2024-0641-03 - An update is now available for Red Hat OpenShift Container Platform 4.14. Issues addressed include denial of service and traversal vulnerabilities.

tags | advisory, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2023-45142
SHA-256 | f65a82d6bfb3405225bcd60e381302fb4fed3d4e5a893e7aace0b5d7b521ee98
Download | Favorite | View
Red Hat Security Advisory 2024-0204-03
Posted Jan 22, 2024
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2024-0204-03 - Red Hat OpenShift Container Platform release 4.14.9 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service
systems | linux, redhat
advisories | CVE-2023-45142
SHA-256 | 13c452422b7d390cd40733ec7dd5ef03b1bcdc41397d15a90f041d64ae8f0ae5
Download | Favorite | View
Red Hat Security Advisory 2023-7663-03
Posted Dec 6, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-7663-03 - Red Hat OpenShift distributed tracing 3.0.0. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service
systems | linux, redhat
advisories | CVE-2023-45142
SHA-256 | b560f99a00fb65f06d1ab6df34adf3cd0f1e5b6c5a32f09b26f7615b68d8c1ad
Download | Favorite | View
Page 1 of 1
Back1Next

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    20 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close