Go/github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver CVE-2024-45043: medium 5.3, EPSS 0.49%
OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability
Action: Upgrade github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver to 0.108.0 or later.
go get github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver@v0.108.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.49.0 | 0.108.0 | - |
Fixed versions
| 0.108.0 |
Sources
- osv: GHSA-prf6-xjxh-p698
- https://github.com/google/security-research/security/advisories/GHSA-q9wq-xc9h-xrw9
- https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-prf6-xjxh-p698
- https://nvd.nist.gov/vuln/detail/CVE-2024-45043
- https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/34847
- https://github.com/open-telemetry/opentelemetry-collector-releases/pull/74
- https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/371bf6afbd7cfa3253fa1674f5444064e86ef0ac
- https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-http
- https://docs.aws.amazon.com/firehose/latest/dev/httpdeliveryrequestresponse.html
- https://github.com/open-telemetry/opentelemetry-collector#alpha
- https://github.com/open-telemetry/opentelemetry-collector-contrib
- https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/awsfirehosereceiver
- https://github.com/open-telemetry/opentelemetry-collector-releases/releases/tag/v0.108.0
- https://github.com/open-telemetry/opentelemetry-collector-releases/tree/main/distributions/otelcol-contrib
CVE-2024-45043 · published · modified · JSON