CVE-2023-47108CWE-770

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

High · published November 10, 2023

CVSS v3.1
7.5
EPSS
2%
Percentile
80.8
In the wild
Unconfirmed
What it is

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02026 · 80.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2023-11-10T18:31Z
EPSS history
Timeline
  • 10 NOV 18:31Z
    DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics
    cvelistv5