CVE-2023-25151
3 advisories.
Go/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp CVE-2023-25151: high 7.5
otelhttp and otelbeego have DoS vulnerability for high cardinality metrics
Action: Upgrade go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to 0.39.0 or later.
go get go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.39.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.38.0 | 0.39.0 | - |
Fixed versions
| 0.39.0 |
Sources
- osv: GHSA-5r5m-65gx-7vrh
- https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh
- https://nvd.nist.gov/vuln/detail/CVE-2023-25151
- https://github.com/open-telemetry/opentelemetry-go-contrib
- https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159
CVE-2023-25151 · published · modified · JSON
Go/go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego CVE-2023-25151: high 7.5
otelhttp and otelbeego have DoS vulnerability for high cardinality metrics
Action: Upgrade go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego to 0.39.0 or later.
go get go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego@v0.39.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.38.0 | 0.39.0 | - |
Fixed versions
| 0.39.0 |
Sources
- osv: GHSA-5r5m-65gx-7vrh#Go/go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego
- https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh
- https://nvd.nist.gov/vuln/detail/CVE-2023-25151
- https://github.com/open-telemetry/opentelemetry-go-contrib
- https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159
CVE-2023-25151 · published · modified · JSON
Go/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp CVE-2023-25151: unknown
Denial of service in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
Action: Upgrade go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to 0.39.0 or later.
go get go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.39.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.38.0 | 0.39.0 | - |
Fixed versions
| 0.39.0 |
Sources
- osv: GO-2023-1546
- https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh
CVE-2023-25151 · published · modified · JSON