{"schema_version":"1.3.1","id":"GO-2024-2900","modified":"2024-07-19T11:15:51Z","published":"2024-06-14T13:41:08Z","aliases":["CVE-2024-36129","GHSA-c74f-6mfw-mm4v"],"summary":"Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc","details":"An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption.","affected":[{"package":{"name":"go.opentelemetry.io/collector/config/configgrpc","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.102.1"}]}],"ecosystem_specific":{"imports":[{"path":"go.opentelemetry.io/collector/config/configgrpc","symbols":["ClientConfig.ToClientConn","getGRPCCompressionName"]}]}},{"package":{"name":"go.opentelemetry.io/collector/config/confighttp","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.102.0"}]}],"ecosystem_specific":{"imports":[{"path":"go.opentelemetry.io/collector/config/confighttp","symbols":["ServerConfig.ToServer","clientInfoHandler.ServeHTTP","decompressor.ServeHTTP","httpContentDecompressor"]}]}}],"references":[{"type":"ADVISORY","url":"https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-collector/pull/10289"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-collector/pull/10323"},{"type":"WEB","url":"https://opentelemetry.io/blog/2024/cve-2024-36129"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2024-2900","review_status":"REVIEWED"}}