Описание
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.
A flaw was found in the @opentelemetry/propagator-jaeger component of OpenTelemetry JavaScript. This vulnerability allows an unauthenticated remote attacker to send specially crafted HTTP header values, specifically uber-trace-id and uberctx-*. The component improperly decodes these values without handling potential errors, leading to an uncaught URIError. Successful exploitation of this flaw can terminate a Node.js process, resulting in a Denial of Service (DoS).
Отчет
This flaw affects the @opentelemetry/propagator-jaeger package used by container images that configure the Jaeger trace-context propagator. Exploitation requires an unauthenticated remote actor to send a crafted uber-trace-id or uberctx-* HTTP header value to a service using JaegerPropagator as its active OpenTelemetry propagator, causing an unhandled URIError that terminates the Node.js process (Denial of Service). Red Hat CVSS score (7.5, Important) is consistent with upstream and NVD scoring.
Меры по смягчению последствий
Administrators can mitigate this issue by not configuring JaegerPropagator as the active OpenTelemetry propagator (use W3C Trace Context or B3 propagation instead), or by deploying an ingress/proxy in front of the affected service that validates or strips uber-trace-id and uberctx-* headers before they reach the application. Upgrading to @opentelemetry/propagator-jaeger >= 2.9.0 resolves the issue upstream.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 | Affected | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 | Affected | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 | Affected | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 | Affected | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 | Affected | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 | Affected | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 | Affected | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9 | Affected | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-transform-jsonata-rhel9 | Affected | ||
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.
EPSS
7.5 High
CVSS3