CVE-2023-47108 (Go, published 2023-11-10T19:15Z)
Description: value: OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/open-telemetry/opentelemetry-go-contrib
Files changed:
CHANGELOG.md
instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go
instrumentation/google.golang.org/grpc/otelgrpc/test/grpc_test.go
Commit message: otelgrpc: Remove high cardinality metric attributes (#4322)



Vulnerable code:
		name, attr := spanInfo(method, cc.Target())
		name, attr := spanInfo(method, cc.Target())
		name, attr := spanInfo(info.FullMethod, peerFromCtx(ctx))
		attr = append(attr, grpcStatusCodeAttr)
		cfg.rpcDuration.Record(ctx, float64(elapsedTime), metric.WithAttributes(attr...))
		name, attr := spanInfo(info.FullMethod, peerFromCtx(ctx))
// spanInfo returns a span name and all appropriate attributes from the gRPC
// method and peer address.
func spanInfo(fullMethod, peerAddress string) (string, []attribute.KeyValue) {
	name, mAttrs := internal.ParseFullMethod(fullMethod)
	attrs := make([]attribute.KeyValue, 0, 1+len(mAttrs)+len(peerAttrs))
	attrs = append(attrs, mAttrs...)
	return name, attrs
	"fmt"
	// TODO: Remove these #4322
	address, ok := findScopeMetricAttribute(rm.ScopeMetrics[0], semconv.NetSockPeerAddrKey)
	assert.True(t, ok)
	port, ok := findScopeMetricAttribute(rm.ScopeMetrics[0], semconv.NetSockPeerPortKey)
	assert.True(t, ok)

								address,
								port,
								address,
								port,

func findScopeMetricAttribute(sm metricdata.ScopeMetrics, key attribute.Key) (attribute.KeyValue, bool) {
	for _, m := range sm.Metrics {
		// This only needs to cover data types used by the instrumentation.
		switch d := m.Data.(type) {
		case metricdata.Histogram[int64]:
			for _, dp := range d.DataPoints {
				if kv, ok := findAttribute(dp.Attributes.ToSlice(), key); ok {
					return kv, true
				}
			}
		case metricdata.Histogram[float64]:
			for _, dp := range d.DataPoints {
				if kv, ok := findAttribute(dp.Attributes.ToSlice(), key); ok {
					return kv, true
				}
			}
		default:
			panic(fmt.Sprintf("unexpected data type %T - name %s", d, m.Name))
		}
	}
	return attribute.KeyValue{}, false
}

Fixed code:
### Removed

- The `net.sock.peer.*` and `net.peer.*` high cardinality attributes are removed from the metrics generated by `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc`. (#4322)

		name, attr, _ := telemetryAttributes(method, cc.Target())
		name, attr, _ := telemetryAttributes(method, cc.Target())
		name, attr, metricAttrs := telemetryAttributes(info.FullMethod, peerFromCtx(ctx))
		metricAttrs = append(metricAttrs, grpcStatusCodeAttr)
		cfg.rpcDuration.Record(ctx, float64(elapsedTime), metric.WithAttributes(metricAttrs...))
		name, attr, _ := telemetryAttributes(info.FullMethod, peerFromCtx(ctx))
// telemetryAttributes returns a span name and span and metric attributes from
// the gRPC method and peer address.
func telemetryAttributes(fullMethod, peerAddress string) (string, []attribute.KeyValue, []attribute.KeyValue) {
	name, methodAttrs := internal.ParseFullMethod(fullMethod)
	attrs := make([]attribute.KeyValue, 0, 1+len(methodAttrs)+len(peerAttrs))
	attrs = append(attrs, methodAttrs...)
	metricAttrs := attrs[:1+len(methodAttrs)]
	return name, attrs, metricAttrs