Update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.44.0 [SECURITY] (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	indirect	minor	v0.42.0 -> v0.44.0

GitHub Vulnerability Alerts

CVE-2023-45142

Summary

OpenTelemetry-Go Contrib has a handler wrapper otelhttp that adds the following labels by deafult that have unbound cardinality:

• http.user_agent
• http.method

This leads to the server's potential memory exhaustion when many malicious requests are sent to it.

Details

HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent.

This pull request released with version 0.44.0 dixes this vulnerability The values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed.

Impact

In order to be affected program has to use otelhttp.NewHandler wrapper and does not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc.

Others

This vulnerability is similar but different from these known vulnerabilities:

• GHSA-5r5m-65gx-7vrh (open-telemetry/opentelemetry-go-contrib)
• GHSA-cg3q-j54f-5p7p (prometheus/client_golang)

Workaround for affected versions

As a workaround, otelhttp.WithFilter() can be used instead, but it requires manual careful configuration to not log certain requests entirely.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[ying-jeanne]

OpenTelemetry is an indirect dependency within Mimir, and it appears that there are no noticeable breaking changes in Mimir. Looks good to me.

[grafanabot]

The backport to release-2.10 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new branch
git switch --create backport-6398-to-release-2.10 origin/release-2.10
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x 514f2b53ed79e4a106c77cf927432a7fa2efb232
# Push it to GitHub
git push --set-upstream origin backport-6398-to-release-2.10
git switch main
# Remove the local backport branch
git branch -D backport-6398-to-release-2.10

Then, create a pull request where the base branch is release-2.10 and the compare/head branch is backport-6398-to-release-2.10.

[grafanabot]

The backport to release-2.9 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new branch
git switch --create backport-6398-to-release-2.9 origin/release-2.9
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x 514f2b53ed79e4a106c77cf927432a7fa2efb232
# Push it to GitHub
git push --set-upstream origin backport-6398-to-release-2.9
git switch main
# Remove the local backport branch
git branch -D backport-6398-to-release-2.9

Then, create a pull request where the base branch is release-2.9 and the compare/head branch is backport-6398-to-release-2.9.