Description:

CVE-2024-36129 is an unsafe decompression vulnerability in the OpenTelemetry Collector that allows unauthenticated attackers to crash the collector by consuming excessive memory. This vulnerability has a CVSS score of 8.2, indicating a high severity level. However, the SOCRadar Vulnerability Risk Score (SVRS) is 44, which is below the critical threshold of 80. This suggests that while the vulnerability is significant, it is not as severe as other vulnerabilities that have been identified.

Key Insights:

• Unauthenticated attackers can exploit this vulnerability remotely: This means that attackers do not need to have any prior access to the target system to exploit this vulnerability.
• The vulnerability can lead to a denial-of-service (DoS) attack: A successful exploit of this vulnerability could cause the OpenTelemetry Collector to crash, making it unavailable to collect and process telemetry data.
• The vulnerability is actively exploited in the wild: This means that attackers are actively using this vulnerability to target systems.

Mitigation Strategies:

• Update the OpenTelemetry Collector to version 0.102.1 or later: This version includes a fix for the vulnerability.
• Disable the confighttp and configgrpc modules: These modules are not required for the operation of the OpenTelemetry Collector and can be disabled to mitigate the risk of exploitation.
• Implement rate limiting: This can help to prevent attackers from exploiting the vulnerability by overwhelming the OpenTelemetry Collector with requests.

Additional Information:

• The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning about this vulnerability.
• There are no known threat actors or APT groups that are actively exploiting this vulnerability.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.