VDB
GO-2024-3066
GO-2024-3066
PUBLISHED
open-telemetry has an Observable Timing Discrepancy in github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | grafana-alloy-fips | 0 |
| chainguard | grafana-alloy | 0 |
| github.com | open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension | 0.80.0, 0.80.0 |
| wolfi | grafana-alloy | 0, 0, 0 |
Timeline
- Aug 13, 2024 CVE Published
- Feb 4, 2026 CVE Updated
- May 1, 2026 Security Advisory
References
- https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-rfxf-mf63-cpqv advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-42368 advisory
- https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/34516 fix
- https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/c9bd3eff0bb357d9c812a0d8defd3b09db95699a fix