High severity · published Jun 5, 2024
CVE-2024-36129
The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Configgrpc · Opentelemetry
before 0.102.1 · source: NVD
CO
Confighttp · Opentelemetry
before 0.102.0 · source: NVD
OC
Opentelemetry Collector · Opentelemetry
before 0.102.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36129
Patch
https://github.com/open-telemetry/opentelemetry-collector/pull/10289
Patch
https://github.com/open-telemetry/opentelemetry-collector/pull/10323
Exploit
https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v
Vendor Advisory
https://opentelemetry.io/blog/2024/cve-2024-36129