OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

未经控制的内存分配

OpenTelemetry .NET 安全漏洞

OpenTelemetry .NET是OpenTelemetry公司的OpenTelemetry的.NET客户端。 OpenTelemetry .NET存在安全漏洞，该漏洞源于baggage、B3和Jaeger处理代码实现细节，可能导致解析时分配过多内存，造成拒绝服务。以下产品及版本受到影响：OpenTelemetry.Api 0.5.0-beta.2版本至1.15.2版本和OpenTelemetry.Extensions.Propagators 1.3.1版本至1.15.2版本。

N/A

N/A