Detections
Analytics

SCA: security update for go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego, go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp (GHSA-5r5m-65gx-7vrh)

high Tenable Self-Hosted Container Security Plugin ID 410995

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of
 `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` uses the `httpconv.ServerRequest` function
 to annotate metric measurements for the `http.server.request_content_length`,
 `http.server.response_content_length`, and `http.server.duration` instruments. The `ServerRequest`
 function sets the `http.target` attribute value to be the whole request URI (including the query
 string)[^1]. The metric instruments do not "forget" previous measurement attributes when `cumulative`
 temporality is used, this means the cardinality of the measurements allocated is directly correlated with
 the unique URIs handled. If the query string is constantly random, this will result in a constant increase
 in memory allocation that can be used in a denial-of-service attack. This issue has been addressed in
 version 0.39.0. Users are advised to upgrade. There are no known workarounds for this issue.
 (CVE-2023-25151)

See Also

https://github.com/advisories/GHSA-5r5m-65gx-7vrh

Plugin Details

Severity: High

ID: 410995

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2023-25151

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/8/2023

Vulnerability Publication Date: 2/8/2023

Reference Information

CVE: CVE-2023-25151

cwe: CWE-400