Opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. There are no known workarounds for this vulnerability.
In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-080.įormula is a math and string formula parser. This issue may lead to an authentication bypass and the creation of system accounts, which effectively can lead to full system compromise. This means that an attacker may be able to augment these JSON strings to be sent to the backend and that can potentially be abused by including new or colliding values. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This issue is fixed in version 1.2.0.ĭataHub is an open-source metadata platform.
This vulnerability can be triggered via the main `gss_accept_sec_context` entry point.
This vulnerability can trigger an out-of-bounds write, leading to memory corruption. This can lead to a denial of service if the write hits unmapped memory or randomly corrupts a byte in the application memory space. The variable `outlen` was not initialized and could cause writing a zero to an arbitrary place in memory if `ntlm_str_convert()` were to fail, which would leave `outlen` uninitialized. Prior to version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication.
0 kommentar(er)
