CVE-2023-45142

Description

Memory exhaustion in go.opentelemetry.io/contrib/instrumentation

How to fix CVE-2023-45142

To remediate CVE-2023-45142, upgrade the affected package to a fixed version below.

• Go/go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful—upgrade to 0.44.0 or later
• Go/go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful—upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later
• —upgrade to 0.44.0 or later

Is CVE-2023-45142 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (14)

• from 0, < 0.44.0
• from 0, < 0.44.0
• from 0, < 0.44.0
• from 0, < 0.44.0
• from 0, < 0.44.0
• from 0, < 0.44.0
• from 0, < 0.44.0

CVSS scores

References (11)

• ADVISORYgithub.com/advisories/GHSA-cg3q-j54f-5p7p
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-45142
• PATCHgithub.com/open-telemetry/opentelemetry-go-contrib
• WEBgithub.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694ad2660b3888eee9c8b896/semconv/internal/v2/http.go#L223