CVE-2024-36129

描述

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.

如何修補 CVE-2024-36129

要修補 CVE-2024-36129,請將受影響套件升級到下列已修補版本。

• —升級至 0.102.1 或更新版本
• —升級至 0.102.1 或更新版本
• —升級至 0.102.1 或更新版本
• —升級至 0.102.0 或更新版本
• —升級至 0.102.0 或更新版本

CVE-2024-36129 正在被利用嗎?

低 — EPSS 為 2.4%,目前沒有觀察到大規模利用活動。

受影響套件(5)

• from 0, < 0.102.1
• from 0, < 0.102.1
• from 0, < 0.102.1
• from 0, < 0.102.0
• from 0, < 0.102.0

CVSS 分數

參考連結(7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-36129
• PATCHgithub.com/open-telemetry/opentelemetry-collector
• WEBgithub.com/open-telemetry/opentelemetry-collector/pull/10289
• WEBgithub.com/open-telemetry/opentelemetry-collector/pull/10323