x/vulndb: potential Go vuln in github.com/open-telemetry/opentelemetry-collector: CVE-2024-36129

[tatianab]

CVE-2024-36129 references github.com/open-telemetry/opentelemetry-collector, which may be a Go module.

Description:
The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-36129
• JSON: https://github.com/CVEProject/cvelist/tree/e076e9c24f3ede5a41143e706602e9c41139fd45/2024/36xxx/CVE-2024-36129.json
• advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-36129
• fix: [confighttp] Apply MaxRequestBodySize to the result of a decompressed body open-telemetry/opentelemetry-collector#10289
• fix: [configgrpc] Use own compressors for zstd open-telemetry/opentelemetry-collector#10323
• web: GHSA-c74f-6mfw-mm4v
• web: https://opentelemetry.io/blog/2024/cve-2024-36129
• Imported by: https://pkg.go.dev/github.com/open-telemetry/opentelemetry-collector?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/open-telemetry/opentelemetry-collector
      vulnerable_at: 0.102.1
      packages:
        - package: opentelemetry-collector
summary: CVE-2024-36129 in github.com/open-telemetry/opentelemetry-collector
cves:
    - CVE-2024-36129
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-36129
    - fix: https://github.com/open-telemetry/opentelemetry-collector/pull/10289
    - fix: https://github.com/open-telemetry/opentelemetry-collector/pull/10323
    - web: https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v
    - web: https://opentelemetry.io/blog/2024/cve-2024-36129
source:
    id: CVE-2024-36129
    created: 2024-06-07T17:18:00.572292-04:00
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/592456 mentions this issue: data/reports: add 19 unreviewed reports

[gopherbot]

Change https://go.dev/cl/592457 mentions this issue: data/reports: add 16 unreviewed reports

[gopherbot]

Change https://go.dev/cl/598592 mentions this issue: data/excluded,data/reports: review 2 reports, add GO-2024-2983