AIKIDO-2024-10321
go.opentelemetry.io/collector/internal/globalgates is vulnerable to Undefined Behavior
40
Medium Risk
This Affects:
go.opentelemetry.io/collector/internal/globalgatesTL;DR
Affected versions of the package are vulnerable to undefined behavior due to improper handling of an error variable. The variable is shared across multiple requests, as it uses the same memory address as an error defined outside the function. This results in memory overwrites, leading to crashes and other unpredictable behavior.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
go.opentelemetry.io/collector/internal/globalgates is vulnerable to Undefined Behavior in versions 0.2.0 - 0.110.0 and 1.0.0 - 1.16.0.
How to fix this
Upgrade the go.opentelemetry.io/collector/internal/globalgates library to a patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant