Bump github.com/docker/docker from 24.0.9+incompatible to 25.0.6+incompatible in /test/e2e #1356
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -73,24 +73,27 @@ require ( | |
| github.com/cheggaaa/pb v1.0.29 // indirect | ||
| github.com/cloudflare/circl v1.3.7 // indirect | ||
| github.com/containerd/console v1.0.4 // indirect | ||
| github.com/containerd/log v0.1.0 // indirect | ||
| github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect | ||
| github.com/cyphar/filepath-securejoin v0.2.4 // indirect | ||
| github.com/davecgh/go-spew v1.1.1 // indirect | ||
| github.com/distribution/reference v0.6.0 // indirect | ||
| github.com/djherbis/times v1.6.0 // indirect | ||
| github.com/docker/cli v24.0.7+incompatible // indirect | ||
| github.com/docker/docker v25.0.6+incompatible // indirect | ||
| github.com/docker/go-connections v0.4.0 // indirect | ||
| github.com/docker/go-units v0.5.0 // indirect | ||
| github.com/emicklei/go-restful/v3 v3.11.0 // indirect | ||
| github.com/emirpasic/gods v1.18.1 // indirect | ||
| github.com/evanphx/json-patch v4.12.0+incompatible // indirect | ||
| github.com/felixge/httpsnoop v1.0.3 // indirect | ||
| github.com/fsnotify/fsnotify v1.7.0 // indirect | ||
| github.com/go-errors/errors v1.4.2 // indirect | ||
| github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect | ||
| github.com/go-git/go-billy/v5 v5.5.0 // indirect | ||
| github.com/go-git/go-git/v5 v5.12.0 // indirect | ||
| github.com/go-logr/logr v1.4.2 // indirect | ||
| github.com/go-logr/stdr v1.2.2 // indirect | ||
| github.com/go-openapi/jsonpointer v0.19.6 // indirect | ||
| github.com/go-openapi/jsonreference v0.20.2 // indirect | ||
| github.com/go-openapi/swag v0.22.3 // indirect | ||
|
|
@@ -192,13 +195,19 @@ require ( | |
| github.com/xanzy/ssh-agent v0.3.3 // indirect | ||
| github.com/xlab/treeprint v1.2.0 // indirect | ||
| github.com/zclconf/go-cty v1.14.4 // indirect | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.1 // indirect | ||
|
There was a problem hiding this comment. 🔴 Library Vulnerabilitygo.opentelemetry.io/contrib/instrumentation/net/http/otelhttp → 0.35.1 OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics (...read more)SummaryThis handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65
that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. DetailsHTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. PoCSend many requests with long randomly generated HTTP methods or/and User agents (e.g. a million) and observe how memory consumption increases during it. ImpactIn order to be affected, the program has to configure a metrics pipeline, use otelhttp.NewHandler wrapper, and does not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. OthersIt is similar to already reported vulnerabilities
Workaround for affected versionsAs a workaround to stop being affected otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label The other possibility is to disable HTTP metrics instrumentation by passing Solution provided by upgradingIn PR open-telemetry/opentelemetry-go-contrib#4277, released with package version 0.44.0, the values collected for attribute References
|
||
| go.opentelemetry.io/otel v1.28.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.28.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.28.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.28.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.28.0 // indirect | ||
| go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect | ||
| go.uber.org/atomic v1.11.0 // indirect | ||
| golang.org/x/crypto v0.24.0 // indirect | ||
| golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 // indirect | ||
| golang.org/x/mod v0.18.0 // indirect | ||
| golang.org/x/net v0.26.0 // indirect | ||
| golang.org/x/oauth2 v0.18.0 // indirect | ||
| golang.org/x/sync v0.7.0 // indirect | ||
| golang.org/x/sys v0.21.0 // indirect | ||
| golang.org/x/term v0.21.0 // indirect | ||
|
|
@@ -207,9 +216,9 @@ require ( | |
| golang.org/x/tools v0.22.0 // indirect | ||
| gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect | ||
| google.golang.org/appengine v1.6.8 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect | ||
| google.golang.org/grpc v1.64.0 // indirect | ||
|
There was a problem hiding this comment. 🟡 Library Vulnerabilitygoogle.golang.org/grpc → 1.64.0 Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go (...read more)ImpactThis issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information. PatchesThe issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0 WorkaroundsIf using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.
There was a problem hiding this comment. 🟡 Library Vulnerabilitygoogle.golang.org/grpc → 1.64.0 Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go (...read more)ImpactThis issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information. PatchesThe issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0 WorkaroundsIf using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.
|
||
| google.golang.org/protobuf v1.34.2 // indirect | ||
| gopkg.in/inf.v0 v0.9.1 // indirect | ||
| gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect | ||
| gopkg.in/warnings.v0 v0.1.2 // indirect | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔴 Library Vulnerability
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp → 0.35.1
OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics (...read more)
Summary
This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65
out of the box adds labels
http.user_agenthttp.methodthat have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it.
Details
HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent.
PoC
Send many requests with long randomly generated HTTP methods or/and User agents (e.g. a million) and observe how memory consumption increases during it.
Impact
In order to be affected, the program has to configure a metrics pipeline, use otelhttp.NewHandler wrapper, and does not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc.
Others
It is similar to already reported vulnerabilities
Workaround for affected versions
As a workaround to stop being affected otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely.
For convenience and safe usage of this library, it should by default mark with the label
unknownnon-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.The other possibility is to disable HTTP metrics instrumentation by passing
otelhttp.WithMeterProvideroption withnoop.NewMeterProvider.Solution provided by upgrading
In PR open-telemetry/opentelemetry-go-contrib#4277, released with package version 0.44.0, the values collected for attribute
http.request.methodwere changed to be restricted to a set of well-known values and other high cardinality attributes were removed.References