id: GO-2023-2331
modules:
    - module: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
      versions:
        - fixed: 0.46.0
      vulnerable_at: 0.45.0
      packages:
        - package: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
          symbols:
            - StreamClientInterceptor
            - UnaryClientInterceptor
            - UnaryServerInterceptor
            - spanInfo
            - StreamServerInterceptor
summary: |-
    Denial of service in
    go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
description: |-
    The grpc Unary Server Interceptor created by the otelgrpc package added the
    labels net.peer.sock.addr and net.peer.sock.port with unbounded cardinality.
    This can lead to the server's potential memory exhaustion when many malicious
    requests are sent. This leads to a denial-of-service.
cves:
    - CVE-2023-47108
ghsas:
    - GHSA-8pgv-569h-w5rw
references:
    - advisory: https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw
    - fix: https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333b
    - fix: https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322
    - web: https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProvider
source:
    id: GHSA-8pgv-569h-w5rw
    created: 2024-06-26T17:06:54.775224-07:00
review_status: REVIEWED
unexcluded: DEPENDENT_VULNERABILITY