Repository navigation
Update module go.opentelemetry.io/otel/sdk to v1.45.0 [SECURITY] - #317
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Generated by renovateBot
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
v1.29.0→v1.45.0OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq
More information
Details
Impact
The OpenTelemetry Go SDK in version
v1.20.0-1.39.0is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code insdk/resource/host_id.goexecutes theioregsystem command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.Patches
This has been patched in d45961b, which was released with
v1.40.0.References
Severity
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
CVE-2026-39883 / GHSA-hfvc-g4fc-pqhx
More information
Details
Summary
The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin
ioregcommand to use an absolute path but left the BSDkenvcommand using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.Root Cause
sdk/resource/host_id.goline 42:Compare with the fixed Darwin path at line 58:
The
execCommandhelper atsdk/resource/host_id_exec.gousesexec.Command(name, arg...)which searches$PATHwhen the command name contains no path separator.Affected platforms (per build tag in
host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.The
kenvpath is reached when/etc/hostiddoes not exist (line 38-40), which is common on FreeBSD systems.Attack
go.opentelemetry.io/otel/sdkkenvbinary earlier in$PATHhostIDReaderBSD.read()callsexec.Command("kenv", ...)which resolves to the malicious binarySame attack vector and impact as CVE-2026-24051.
Suggested Fix
Use the absolute path:
On FreeBSD,
kenvis located at/bin/kenv.Severity
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
CVE-2026-81870 / GHSA-8wmf-6v46-5gfg
More information
Details
Summary
OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK
TracerProvideris created. The default OpenTelemetry logger does not emit this event. Exposure requires an application to install a logger that enables OpenTelemetry's internal Info-level diagnostics and for someone other than the intended audience to have access to those logs.The logged configuration can disclose the address of the trace collector and whether the OTLP/HTTP connection is configured as insecure. The Zipkin exporter logs its complete collector URL, so credentials in URL userinfo or tokens in the query string are also disclosed if an application embeds them there. OTLP authentication headers, TLS key material, and exported span data are not included in this log.
Exporter
MarshalLogimplementations that caused this configuration to be included in internal logs were introduced bya1fff3c.Details
When
sdk/trace.NewTracerProviderconstructs a provider, it records aTracerProvider createdinternal Info event containing the provider configuration. In affected versions, the configuration'sMarshalLogmethods recursively include:This causes the following values to be present in the event:
Insecureflag; andOpenTelemetry Go does not emit this event with its default logger, which only emits errors. An application must explicitly configure a sufficiently verbose logger with
otel.SetLogger. The requiredlogrverbosity is version-dependent:V(1)for this Info event; andV(4).OTLP header configuration is not part of the marshaled object, so credentials supplied with
WithHeadersor the corresponding environment variables are not exposed. The documented OTLPWithEndpointinput is a collector address rather than a credential-bearing URL. The higher-risk case is therefore the Zipkin collector URL, which is retained and logged in full, or an application passing sensitive data in an OTLP endpoint outside the documented format.Proof of concept
The following program demonstrates the behavior with OpenTelemetry Go 1.44.0. It deliberately places credentials and a token in the Zipkin collector URL and enables internal Info logging:
The
TracerProvider createdevent contains:For versions before 1.15.0, set
funcr.Options{Verbosity: 1}instead.Impact
This is a conditional disclosure through application logs. Affected applications must enable verbose OpenTelemetry internal diagnostics and configure a trace exporter containing information they do not intend to expose to readers of those logs. In that configuration, a person or system with log access can learn the trace collector address and internal network topology. If credentials or tokens are embedded directly in a Zipkin collector URL, those values can also be recovered from the logs.
There is no exposure with the default OpenTelemetry logger, and the vulnerable log is generated from local application configuration rather than remotely supplied span data. OTLP authentication headers, certificate or private-key contents, and telemetry payloads are not logged by this path.
Remediation
Upgrade the affected OpenTelemetry Go modules to version 1.45.0 or later. The fix in
3a1412dstops recursively marshaling exporter and client configuration and records their types instead.If an immediate upgrade is not possible:
Severity
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
CVE-2026-81869 / GHSA-p9f8-wvj8-2fg8
More information
Details
Summary
The OpenTelemetry Go SDK trace package can fail to enforce
AttributeValueLengthLimitfor string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured memory/DoS protection and allowing increased per-span memory usage. The finding is low severity because it requires a deployment with attribute value length limits enabled and attacker-controlled data being recorded into span attributes.Introduced in commit 49a6536
Details
String and string-slice span attributes are truncated through
safeTruncatewhenAttributeValueLengthLimitis non-negative. The finding evidence identifies this enforcement path insdk/trace/span.go:303-331, with string attributes passed tosafeTruncateatsdk/trace/span.go:309-310and string-slice entries passed tosafeTruncatein the loop beginning atsdk/trace/span.go:312.safeTruncatefirst callssafeTruncateValidUTF8; if that returnsok=false, it callsstrings.ToValidUTF8(input, "")and retries. The relevant code is identified insdk/trace/span.go:337-355.safeTruncateValidUTF8treats anyutf8.RuneErrorfromutf8.DecodeRuneInStringas invalid UTF-8 and immediately returns the original input withok=false. However, Go also returnsutf8.RuneErrorfor a valid encoded U+FFFD rune. The validation artifact confirms this behavior with outputr=U+FFFD size=3 runeError=true.For an input such as
"AAAA" + U+FFFD + strings.Repeat("B", 20)and a limit of 5, the first truncation attempt sees U+FFFD asutf8.RuneErrorand returns the full input withok=false.strings.ToValidUTF8does not remove the valid U+FFFD rune, so the second attempt returns the same full input. As a result, the span attribute value remains 27 bytes long even though the configured limit is 5.PoC
validation-artifact.zip
The validation artifact contains a package-level Go test at
validation-artifact.tar:safe_truncate_bypass/safe_truncate_poc_test.goand supporting output atvalidation-artifact.tar:safe_truncate_bypass/runecheck_output.txt.Reproduction configuration:
pellared/opentelemetry-go49a6536from September 12, 2022sdk/traceunder thesdkmodulelimit := 5Commands:
Expected vulnerable output includes a failing test showing that the returned value exceeds the configured limit:
The artifact also records the standalone UTF-8 behavior needed for the bypass:
Expected output:
Impact
This is a Unicode handling and resource-limit bypass that weakens span attribute memory controls. Applications that enable
AttributeValueLengthLimitto bound memory usage can still store oversized attacker-controlled attribute values if those values contain U+FFFD. The practical impact is increased memory use and reduced denial-of-service protection in the instrumented process; the finding does not show confidentiality or integrity impact.Severity
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/sdk)
v1.45.0: /v0.67.0/v0.21.0/v0.0.18Compare Source
Overview
Added
BatchProcessoringo.opentelemetry.io/otel/sdk/log. (#7124)WithUnsafeAttributesno-copy attribute option togo.opentelemetry.io/otel/metric/xfor future performance improvements. This API is a work in progress. (#8251)MapandMapValuefunctions for the newMAPattribute type ingo.opentelemetry.io/otel/attribute. (#8445)MAPattributes ingo.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)MAPattributes ingo.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)MAPattributes ingo.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)MAPattributes ingo.opentelemetry.io/otel/exporters/zipkin. (#8453)AttributeValueLengthLimitrecursively to values contained inattribute.MAPattributes ingo.opentelemetry.io/otel/sdk/trace. (#8454)attribute.MAPvalues ingo.opentelemetry.io/otel/sdk/resourceusing last-value-wins semantics. (#8471)attribute.MAPvalues in instrumentation scope attributes ingo.opentelemetry.io/otel/sdk/logusing last-value-wins semantics. (#8471)attribute.MAPvalues in span, event, link, and instrumentation scope attributes ingo.opentelemetry.io/otel/sdk/traceusing last-value-wins semantics. (#8471)attribute.MAPvalues in measurement and instrumentation scope attributes ingo.opentelemetry.io/otel/sdk/metricusing last-value-wins semantics. (#8471)WithAllowKeyDuplicationingo.opentelemetry.io/otel/sdk/logto disable duplicate-key removal inattribute.MAPvalues for instrumentation scope attributes. (#8471)go.opentelemetry.io/otel/semconv/v1.42.0package.The package contains semantic conventions from the
v1.42.0version of the OpenTelemetry Semantic Conventions.See the migration documentation for information on how to upgrade from
go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)WithoutPanicRecordingas aTracerProviderOptioningo.opentelemetry.io/otel/sdk/traceto disable exception event recording for panics. (#8532)go.opentelemetry.io/otel/semconv/v1.43.0package.The package contains semantic conventions from the
v1.43.0version of the OpenTelemetry Semantic Conventions.See the migration documentation for information on how to upgrade from
go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)Changed
HistogramReservoiringo.opentelemetry.io/otel/sdk/metric/exemplarnow uses a time-unbiased sampling algorithm for exemplars. (#8306)go.opentelemetry.io/otel/attribute.Valueandgo.opentelemetry.io/otel/attribute.KeyValuefor log bodies and attributes ingo.opentelemetry.io/otel/log,go.opentelemetry.io/otel/log/logtest,go.opentelemetry.io/otel/sdk/log, andgo.opentelemetry.io/otel/sdk/log/logtest. (#8490)go.opentelemetry.io/otel/attribute.ValueJSON ingo.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)BOOLSLICE,INT64SLICE,FLOAT64SLICE, andSTRINGSLICEattribute values by avoiding reflection for short slices ingo.opentelemetry.io/otel/attribute. (#8511)WithEndpointURLingo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttpno longer appends the default signal path when an endpoint URL has no path, making the behavior consistent withgo.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttpand with setting the endpoint throughOTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. UseWithEndpointURL(url.JoinPath(endpoint, "/v1/metrics"))to preserve the previous behavior. (#8538)WithEndpointURLingo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpno longer appends the default signal path when an endpoint URL has no path, making the behavior consistent withgo.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttpand with setting the endpoint throughOTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. UseWithEndpointURL(url.JoinPath(endpoint, "/v1/traces"))to preserve the previous behavior. (#8538)Deprecated
WithExportBufferSizeingo.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior;BatchProcessorno longer maintains a separate export-request buffer. (#8620)Removed
Kind,Value,KeyValue, their constructors, and attribute conversion helpers fromgo.opentelemetry.io/otel/log. (#8490)AttributeValueLengthLimitandAttributeCountLimitfields fromRecordFactoryingo.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)Fixed
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.go.opentelemetry.io/otel/bridge/opentracingwhen OpenTracing baggage is propagated concurrently withSpan.SetBaggageItem.FixedSizeReservoiringo.opentelemetry.io/otel/sdk/metric/exemplarthat prevented the first exemplar from being sampled after the reservoir was filled. (#8309)Retry-Afterheader values as seconds instead of nanoseconds when retrying OTLP HTTP exports ingo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp,go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, andgo.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)Reservoirimplementation ingo.opentelemetry.io/otel/sdk/metric/exemplar, where storing the fullcontext.Contextpinned large objects such as gRPC transport buffers. (#8389)go.opentelemetry.io/otel/attribute. (#8402)go.opentelemetry.io/otel/sdk/metricaggregation to avoid leaking stale sum, minimum, and maximum values when they are disabled in subsequent collections. (#8403)go.opentelemetry.io/otel/exporters/prometheus. (#8404)Retry-Afterheader when retrying OTLP HTTP exports ingo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp,go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, andgo.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8417)BucketCountsandExemplarsslices acrossCollectcycles in the cumulative histogram aggregation ingo.opentelemetry.io/otel/sdk/metric. (#8428)go.opentelemetry.io/otel/exporters/stdout/stdouttraceself-observability to recorderror.typeon the operation-duration histogram when theexportedSpansmetric is disabled. (#8432)go.opentelemetry.io/otel/sdk/trace,go.opentelemetry.io/otel/exporters/otlp/otlptrace,go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc,go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, andgo.opentelemetry.io/otel/exporters/zipkin. (#8438)go.opentelemetry.io/otel/codes. (#8497)go.opentelemetry.io/otel/logthatLogger.Enabledshould be checked for every log emission because its result may change over time. (#8565)go.opentelemetry.io/otel/sdk/log. (#8566)WithAttributeCountLimit(0)andOTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT=0discard all log record attributes ingo.opentelemetry.io/otel/sdk/log. (#8570)Recordmethods ofFloat64HistogramandInt64Histogramingo.opentelemetry.io/otel/metricexpect non-negative values. (#8574)go.opentelemetry.io/otel/logthatLoggerProviderimplementations should retain an emptyLoggername instead of replacing it with a default. (#8587)go.opentelemetry.io/otel/sdk/logcall exporterForceFlushduringShutdown. (#8599)go.opentelemetry.io/otel/bridge/opentracingwhen OpenTracing baggage is propagated concurrently withSpan.SetBaggageItem. (GHSA-42cj-99w8-cp2p)go.opentelemetry.io/otel/sdk/logfrom overlapping with processor shutdown or running afterLoggerProvidershutdown. (#8608)BatchProcessoringo.opentelemetry.io/otel/sdk/logfrom busy-spinning under exporter backpressure and serialize dequeue, export, force-flush, and shutdown work in one worker. (#8620)BatchProcessoringo.opentelemetry.io/otel/sdk/logreturn errors encountered while draining records duringForceFlushandShutdown, while continuing to attempt later batches as long as the request context remains valid. (#8620)BatchProcessormaximum export batch size ingo.opentelemetry.io/otel/sdk/logat or below the configured maximum queue size. (#8620)What's Changed
bc171b2by @renovate[bot] in #8405c761662by @renovate[bot] in #83846cf7526by @renovate[bot] in #84080ec5bd2by @renovate[bot] in #84194308a22by @renovate[bot] in #844035bcb73by @renovate[bot] in #84367ab31c2by @renovate[bot] in #8447fb80ec8by @renovate[bot] in #84442399af7by @renovate[bot] in #846072dfd24by @renovate[bot] in #846262b3387by @renovate[bot] in #84634de325eby @renovate[bot] in #84669b6dc03by @renovate[bot] in #847487f3d3eby @renovate[bot] in #8483a6991f1by @renovate[bot] in #8482e028baeby @renovate[bot] in #8493semconv/v1.42.0by @MrAlias in #8484f39628cby @renovate[bot] in #8498b703f56by @renovate[bot] in #8502c961bd5by @renovate[bot] in #851259b4966by @renovate[bot] in #8520b709645by @renovate[bot] in #8523925bb5dby @renovate[bot] in #8533Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.