AIKIDO-2024-10320
go.opentelemetry.io/collector/config/confignet is vulnerable to Undefined Behavior
40
Medium Risk
This Affects:
go.opentelemetry.io/collector/config/confignetTL;DR
Affected versions of the package are vulnerable to undefined behavior. An error variable is shared between requests because it uses the same address as the error defined outside the function. This causes an UB because memory is overwritten and this will cause crashes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
go.opentelemetry.io/collector/config/confignet is vulnerable to Undefined Behavior in versions 0.2.0 - 0.110.0 and 1.0.0 - 1.16.0.
How to fix this
Upgrade the go.opentelemetry.io/collector/config/confignet library to a patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant