Buffer overflow in OpenTelemetry Collector - CVE-2024-36129

Vulnerability identifier: #VU91596

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-36129

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the Zip/Decompression Bomb sent over HTTP or gRPC. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.

OpenTelemetry Collector
Agent
Splunk Enterprise
Red Hat OpenShift distributed tracing (RHOSDT)
App Connect Enterprise Certified Container

Install updates from vendor's website.

OpenTelemetry Collector - addressed in versions 0.102.0, 0.102.1
Agent - update to 0.41.1
Splunk Enterprise - addressed in versions 9.1.7, 9.2.4, 9.3.2
Red Hat OpenShift distributed tracing (RHOSDT) - update to 3.2.1
App Connect Enterprise Certified Container - update to 5.0.19

• https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v
• https://github.com/open-telemetry/opentelemetry-collector/pull/10289
• https://github.com/open-telemetry/opentelemetry-collector/pull/10323
• https://opentelemetry.io/blog/2024/cve-2024-36129

• Denial of service in OpenTelemetry Collector
• Denial of service in Agent
• Buffer overflow in Red Hat OpenShift distributed tracing (RHOSDT) 3.2
• Buffer overflow in IBM App Connect Enterprise Certified Container
• Splunk Enterprise update for third-party components