OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. The bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of the received & configured bearer tokens. This impacts anyone using the `bearertokenauth` server authenticator. Malicious clients with network access to the collector may perform a timing attack against a collector with this authenticator to guess the configured token, by iteratively sending tokens and comparing the response time. This would allow an attacker to introduce fabricated or bad data into the collector's telemetry pipeline. The observable timing vulnerability was fixed by using constant-time comparison in 0.107.0

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for     instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. The     bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of     the received & configured bearer tokens. This impacts anyone using the `bearertokenauth` server     authenticator. Malicious clients with network access to the collector may perform a timing attack against     a collector with this authenticator to guess the configured token, by iteratively sending tokens and     comparing the response time. This would allow an attacker to introduce fabricated or bad data into the     collector's telemetry pipeline. The observable timing vulnerability was fixed by using constant-time     comparison in 0.107.0 (CVE-2024-42368)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for
    instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. The
    bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of
    the received & configured bearer tokens. This impacts anyone using the `bearertokenauth` server
    authenticator. Malicious clients with network access to the collector may perform a timing attack against
    a collector with this authenticator to guess the configured token, by iteratively sending tokens and
    comparing the response time. This would allow an attacker to introduce fabricated or bad data into the
    collector's telemetry pipeline. The observable timing vulnerability was fixed by using constant-time
    comparison in 0.107.0 (CVE-2024-42368)

The OpenTelemetry Collector running on the remote host is prior to 0.107.0. It is, therefore, affected by a timing discrepancy vulnerability, outlined below:

The bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of the received & configured bearer tokens. This impacts anyone using the `bearertokenauth` server authenticator. Malicious clients with network access to the collector may perform a timing attack against a collector with this authenticator to guess the configured token, by iteratively sending tokens and comparing the response time. This would allow an attacker to introduce fabricated or bad data into the collector's telemetry pipeline.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
228761	Linux Distros Unpatched Vulnerability : CVE-2024-42368	Nessus	Misc.	medium
418714	SCA: security update for github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension (GHSA-rfxf-mf63-cpqv)	Tenable Cloud Security	SCA Checks	medium
418714	SCA: security update for github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension (GHSA-rfxf-mf63-cpqv)	Tenable Self-Hosted Container Security	SCA Checks	medium
205617	OpenTelemetry Collector < 0.107.0 Timing Discrepancy	Nessus	Misc.	medium

Detections

Analytics

CVE-2024-42368

medium

Tenable Plugins

medium

medium

medium

medium