RHSA-2023%3A7663 — Vulnetix

RHSA-2023%3A7663 PUBLISHED CVSS 7.5 HIGH

A memory leak was found in the otelhttp handler of open-telemetry. This flaw allows a remote, unauthenticated attacker to exhaust the server's memory by sending many malicious requests, affecting the availability.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

…and 124 more

Timeline

Dec 6, 2023 CVE Published
Apr 25, 2026 Distribution Patch
Apr 25, 2026 Distribution Patch
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
Apr 25, 2026 Security Advisory
May 15, 2026 CVE Updated

References

https://access.redhat.com/errata/RHSA-2023:7663 advisory
https://access.redhat.com/security/updates/classification/#important advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2245180 issue
https://bugzilla.redhat.com/show_bug.cgi?id=2246986 issue
https://issues.redhat.com/browse/TRACING-1805 advisory
https://issues.redhat.com/browse/TRACING-3217 advisory
https://issues.redhat.com/browse/TRACING-3379 advisory
https://issues.redhat.com/browse/TRACING-3510 advisory
https://issues.redhat.com/browse/TRACING-3523 advisory
https://issues.redhat.com/browse/TRACING-3555 advisory
https://issues.redhat.com/browse/TRACING-3568 advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7663.json advisory
https://access.redhat.com/security/cve/CVE-2023-45142 advisory
https://www.cve.org/CVERecord?id=CVE-2023-45142 advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-45142 advisory
https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmr advisory
https://access.redhat.com/security/cve/CVE-2023-46129 advisory
https://www.cve.org/CVERecord?id=CVE-2023-46129 advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-46129 advisory
https://advisories.nats.io/CVE/secnote-2023-02.txt advisory

…and 1 more

Open in Interactive Console →

Vendor	Product	Versions
Red Hat	rhosdt/opentelemetry-operator-bundle@sha256:122c8f6101ea0288ec045d15e1d19a2d1d61aae3d04c9422128a2f7429e51ff5_s390x as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/opentelemetry-operator-bundle@sha256:122c8f6101ea0288ec045d15e1d19a2d1d61aae3d04c9422128a2f7429e51ff5_s390x, *
Red Hat	rhosdt/jaeger-rhel8-operator@sha256:2789597df07b8dd04c3e95938a94d9b0f40e7c048e3fb58e3c4b84eea7e564a7_s390x as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/jaeger-rhel8-operator@sha256:2789597df07b8dd04c3e95938a94d9b0f40e7c048e3fb58e3c4b84eea7e564a7_s390x, *, rhosdt/jaeger-rhel8-operator@sha256:2789597df07b8dd04c3e95938a94d9b0f40e7c048e3fb58e3c4b84eea7e564a7_s390x
Red Hat	rhosdt/opentelemetry-collector-rhel8@sha256:7c8e08a1a466603304a4543bfb03b86edfb4db8d1633e4a5c51ed706f94f95c6_amd64 as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/opentelemetry-collector-rhel8@sha256:7c8e08a1a466603304a4543bfb03b86edfb4db8d1633e4a5c51ed706f94f95c6_amd64, rhosdt/opentelemetry-collector-rhel8@sha256:7c8e08a1a466603304a4543bfb03b86edfb4db8d1633e4a5c51ed706f94f95c6_amd64
Red Hat	rhosdt/tempo-operator-bundle@sha256:913fdedf596886841dbf0a0fafbbc75330df2a03e966950a7dab5b5cd4caba13_s390x as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/tempo-operator-bundle@sha256:913fdedf596886841dbf0a0fafbbc75330df2a03e966950a7dab5b5cd4caba13_s390x, *
Red Hat	rhosdt/tempo-rhel8@sha256:0baf5285f10484b25ba140b147df587eaaac146e32b2ced643fda52eb6353859_ppc64le as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/tempo-rhel8@sha256:0baf5285f10484b25ba140b147df587eaaac146e32b2ced643fda52eb6353859_ppc64le, rhosdt/tempo-rhel8@sha256:0baf5285f10484b25ba140b147df587eaaac146e32b2ced643fda52eb6353859_ppc64le, rhosdt/tempo-rhel8@sha256:0baf5285f10484b25ba140b147df587eaaac146e32b2ced643fda52eb6353859_ppc64le
Red Hat	rhosdt/jaeger-rhel8-operator@sha256:2789597df07b8dd04c3e95938a94d9b0f40e7c048e3fb58e3c4b84eea7e564a7_s390x as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/jaeger-rhel8-operator@sha256:2789597df07b8dd04c3e95938a94d9b0f40e7c048e3fb58e3c4b84eea7e564a7_s390x, rhosdt/jaeger-rhel8-operator@sha256:2789597df07b8dd04c3e95938a94d9b0f40e7c048e3fb58e3c4b84eea7e564a7_s390x
Red Hat	rhosdt/tempo-query-rhel8@sha256:28f5c9a3ad4551bd0445b1a637151e3f112706637f0bfdc3dc4968648b8f404f_arm64 as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/tempo-query-rhel8@sha256:28f5c9a3ad4551bd0445b1a637151e3f112706637f0bfdc3dc4968648b8f404f_arm64, rhosdt/tempo-query-rhel8@sha256:28f5c9a3ad4551bd0445b1a637151e3f112706637f0bfdc3dc4968648b8f404f_arm64
Red Hat	rhosdt/tempo-operator-bundle@sha256:6dcb68ace16c0e82ce12e808f3ac4886ef663bd76e38eb2ce8c3a1fa65e6de68_arm64 as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/tempo-operator-bundle@sha256:6dcb68ace16c0e82ce12e808f3ac4886ef663bd76e38eb2ce8c3a1fa65e6de68_arm64, rhosdt/tempo-operator-bundle@sha256:6dcb68ace16c0e82ce12e808f3ac4886ef663bd76e38eb2ce8c3a1fa65e6de68_arm64
Red Hat	rhosdt/tempo-gateway-rhel8@sha256:0b391aee88ed6f569737ab84082966715ac26e9bb3d9ca0517578f77fa54e4e9_ppc64le as a component of Red Hat OpenShift distributed tracing 3.0	, , rhosdt/tempo-gateway-rhel8@sha256:0b391aee88ed6f569737ab84082966715ac26e9bb3d9ca0517578f77fa54e4e9_ppc64le
Red Hat	rhosdt/jaeger-query-rhel8@sha256:df0b1ae25db7de9281aea724f4358aabd3fab116584545edadedc1324282285c_arm64 as a component of Red Hat OpenShift distributed tracing 3.0	, , *
Red Hat	rhosdt/jaeger-agent-rhel8@sha256:6051b1c3f9238bcfb496df7ff68638f8e14483ccac30d33fb0ca590b0f946473_amd64 as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/jaeger-agent-rhel8@sha256:6051b1c3f9238bcfb496df7ff68638f8e14483ccac30d33fb0ca590b0f946473_amd64, rhosdt/jaeger-agent-rhel8@sha256:6051b1c3f9238bcfb496df7ff68638f8e14483ccac30d33fb0ca590b0f946473_amd64
Red Hat	rhosdt/tempo-rhel8@sha256:bc45d1ca3f6f7ef339d1270ff6c4ca392fdbb7d36f5e8b5b76458ff56254d34c_s390x as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/tempo-rhel8@sha256:bc45d1ca3f6f7ef339d1270ff6c4ca392fdbb7d36f5e8b5b76458ff56254d34c_s390x, rhosdt/tempo-rhel8@sha256:bc45d1ca3f6f7ef339d1270ff6c4ca392fdbb7d36f5e8b5b76458ff56254d34c_s390x
Red Hat	rhosdt/jaeger-es-index-cleaner-rhel8@sha256:ee207170af3cbedc86820c205a84ba07dd8b3a85a365f77642e6a3a8a8bffd01_amd64 as a component of Red Hat OpenShift distributed tracing 3.0	*, rhosdt/jaeger-es-index-cleaner-rhel8@sha256:ee207170af3cbedc86820c205a84ba07dd8b3a85a365f77642e6a3a8a8bffd01_amd64, rhosdt/jaeger-es-index-cleaner-rhel8@sha256:ee207170af3cbedc86820c205a84ba07dd8b3a85a365f77642e6a3a8a8bffd01_amd64
Red Hat	rhosdt/jaeger-all-in-one-rhel8@sha256:100cb4237de731039f1689a98eadce7a4ab32610585b88bd39421e5bcbc4ff0f_s390x as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/jaeger-all-in-one-rhel8@sha256:100cb4237de731039f1689a98eadce7a4ab32610585b88bd39421e5bcbc4ff0f_s390x, rhosdt/jaeger-all-in-one-rhel8@sha256:100cb4237de731039f1689a98eadce7a4ab32610585b88bd39421e5bcbc4ff0f_s390x, *
Red Hat	rhosdt/jaeger-es-rollover-rhel8@sha256:6a9f07800179639aaf394b1e2b00ec6ea2d9c698329c40c9e9e7fc805c9250d3_ppc64le as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/jaeger-es-rollover-rhel8@sha256:6a9f07800179639aaf394b1e2b00ec6ea2d9c698329c40c9e9e7fc805c9250d3_ppc64le, rhosdt/jaeger-es-rollover-rhel8@sha256:6a9f07800179639aaf394b1e2b00ec6ea2d9c698329c40c9e9e7fc805c9250d3_ppc64le
Red Hat	rhosdt/tempo-rhel8-operator@sha256:59084d728b66eda4cadf932d89a560cc1e9c6485374cf911e7065799ceec5f89_arm64 as a component of Red Hat OpenShift distributed tracing 3.0	, rhosdt/tempo-rhel8-operator@sha256:59084d728b66eda4cadf932d89a560cc1e9c6485374cf911e7065799ceec5f89_arm64,
Red Hat	rhosdt/jaeger-query-rhel8@sha256:78e660916be15db85341c6b37660193d603320acc1b43073083befd4eb386b1d_ppc64le as a component of Red Hat OpenShift distributed tracing 3.0	, , rhosdt/jaeger-query-rhel8@sha256:78e660916be15db85341c6b37660193d603320acc1b43073083befd4eb386b1d_ppc64le
Red Hat	rhosdt/jaeger-query-rhel8@sha256:6a898bfa2a63260f9bcd16929d533f14e706bd2383a46f740e789d1d097c0bed_amd64 as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/jaeger-query-rhel8@sha256:6a898bfa2a63260f9bcd16929d533f14e706bd2383a46f740e789d1d097c0bed_amd64, ,
Red Hat	rhosdt/tempo-query-rhel8@sha256:e5860305c2f4d8b276b484e3db15fe5f7444649d9d76ce9664dc286f33a8363c_ppc64le as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/tempo-query-rhel8@sha256:e5860305c2f4d8b276b484e3db15fe5f7444649d9d76ce9664dc286f33a8363c_ppc64le, ,
Red Hat	rhosdt/opentelemetry-collector-rhel8@sha256:b3aa8974f76f845b1eaa8c936b39e03bb66e6cdbc143f207958297a819c84d5b_ppc64le as a component of Red Hat OpenShift distributed tracing 3.0	rhosdt/opentelemetry-collector-rhel8@sha256:b3aa8974f76f845b1eaa8c936b39e03bb66e6cdbc143f207958297a819c84d5b_ppc64le, rhosdt/opentelemetry-collector-rhel8@sha256:b3aa8974f76f845b1eaa8c936b39e03bb66e6cdbc143f207958297a819c84d5b_ppc64le