opentelemetry_exporter_otlp_proto_grpc-1.44.0-py3-none-any.whl: 1 vulnerabilities (highest severity is: 5.3)

Aperta Adatta ai principianti
  • Qualcosa non va?
#522 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
70/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
python
Ambito
devops, security

Direzione di ricerca

Inizia da examples/strands/code-assistant/pyproject.toml ed esamina come viene dichiarata e bloccata la dipendenza dell’esportatore OpenTelemetry. Verifica se l’API OpenTelemetry può essere aggiornata alla versione 1.45.1, indicata come correttiva per CVE-2026-114603. Il lavoro è completato quando le dipendenze dell’esempio vengono risolte senza la versione vulnerabile.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Mend: dependency security vulnerability untriaged
Vulnerable Library - opentelemetry_exporter_otlp_proto_grpc-1.44.0-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/opentelemetry_api-1.44.0.dist-info

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (opentelemetry_exporter_otlp_proto_grpc version) Remediation Possible**
CVE-2026-114603 Medium 5.3 opentelemetry_api-1.44.0-py3-none-any.whl Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-114603
Vulnerable Library - opentelemetry_api-1.44.0-py3-none-any.whl

OpenTelemetry Python API

Library home page: https://files.pythonhosted.org/packages/ca/6f/a04e900f465ff3221ccc395522503e2d10e79fa21f2723c8e177aae1e0d1/opentelemetry_api-1.44.0-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/opentelemetry_api-1.44.0.dist-info

Dependency Hierarchy:

  • opentelemetry_exporter_otlp_proto_grpc-1.44.0-py3-none-any.whl (Root Library)
    • ❌ opentelemetry_api-1.44.0-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Found in base branch: main

Vulnerability Details

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.

Publish Date: 2026-10-22

URL: CVE-2026-114603

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-22

Fix Resolution: opentelemetry-api - 1.45.1

Lingua principale
JavaScript
Stelle
44
Fork
41
Merge medio
1g 9h
PR unite (30g)
17

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di opensearch-project/observability-stack

Tutte le issue di opensearch-project/observability-stack

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.