OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it. https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmr https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.19.0 https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277
Created golang-opentelemetry-contrib-0.20 tracking bugs for this issue: Affects: fedora-all [bug 2245181]
Created caddy tracking bugs for this issue: Affects: epel-8 [bug 2246579] Affects: fedora-37 [bug 2246580] Affects: fedora-38 [bug 2246587] Created cri-o:1.26/cri-tools tracking bugs for this issue: Affects: fedora-37 [bug 2246581] Affects: fedora-38 [bug 2246588] Created cri-o:1.27/cri-tools tracking bugs for this issue: Affects: fedora-37 [bug 2246582] Affects: fedora-38 [bug 2246589] Created golang-github-quay-clair-4 tracking bugs for this issue: Affects: fedora-37 [bug 2246583] Created golang-k8s-apiextensions-apiserver tracking bugs for this issue: Affects: fedora-38 [bug 2246590] Created golang-k8s-kube-aggregator tracking bugs for this issue: Affects: fedora-37 [bug 2246584] Created golang-k8s-pod-security-admission tracking bugs for this issue: Affects: fedora-37 [bug 2246585] Created golang-k8s-sample-apiserver tracking bugs for this issue: Affects: fedora-37 [bug 2246586]
This issue has been addressed in the following products: OADP-1.3-RHEL-9 Via RHSA-2023:7555 https://access.redhat.com/errata/RHSA-2023:7555
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2023:7469 https://access.redhat.com/errata/RHSA-2023:7469
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2023:7470 https://access.redhat.com/errata/RHSA-2023:7470
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2023:7599 https://access.redhat.com/errata/RHSA-2023:7599
Created caddy tracking bugs for this issue: Affects: epel-8 [bug 2253046]
This issue has been addressed in the following products: Red Hat Openshift distributed tracing 3.0 Via RHSA-2023:7663 https://access.redhat.com/errata/RHSA-2023:7663
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2023:7681 https://access.redhat.com/errata/RHSA-2023:7681
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2023:7682 https://access.redhat.com/errata/RHSA-2023:7682
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2023:7831 https://access.redhat.com/errata/RHSA-2023:7831
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:0050 https://access.redhat.com/errata/RHSA-2024:0050
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:0204 https://access.redhat.com/errata/RHSA-2024:0204
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2024:0660 https://access.redhat.com/errata/RHSA-2024:0660
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:0641 https://access.redhat.com/errata/RHSA-2024:0641
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:0642 https://access.redhat.com/errata/RHSA-2024:0642
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2024:0833 https://access.redhat.com/errata/RHSA-2024:0833
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2023:7197 https://access.redhat.com/errata/RHSA-2023:7197
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2023:7198 https://access.redhat.com/errata/RHSA-2023:7198
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:0766 https://access.redhat.com/errata/RHSA-2024:0766
This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 Via RHSA-2024:1328 https://access.redhat.com/errata/RHSA-2024:1328
This issue has been addressed in the following products: OADP-1.3-RHEL-9 Via RHSA-2024:1859 https://access.redhat.com/errata/RHSA-2024:1859
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:2773 https://access.redhat.com/errata/RHSA-2024:2773
This issue has been addressed in the following products: Red Hat Ceph Storage 5.3 Via RHSA-2024:4118 https://access.redhat.com/errata/RHSA-2024:4118
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:0041 https://access.redhat.com/errata/RHSA-2024:0041
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:5433 https://access.redhat.com/errata/RHSA-2024:5433
This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 Via RHSA-2024:6236 https://access.redhat.com/errata/RHSA-2024:6236
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:6406 https://access.redhat.com/errata/RHSA-2024:6406
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2024:6811 https://access.redhat.com/errata/RHSA-2024:6811
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2024:7921 https://access.redhat.com/errata/RHSA-2024:7921
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:8991 https://access.redhat.com/errata/RHSA-2024:8991