Improper Removal of Sensitive Information Before Storage or Transfer Affecting opentelemetry.instrumentation.http package, versions [,1.8.1)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-OPENTELEMETRYINSTRUMENTATIONHTTP-6613065
- published 14 Apr 2024
- disclosed 12 Apr 2024
- credit Unknown
Introduced: 12 Apr 2024
New CVE-2024-32028 Open this link in a new tabHow to fix?
Upgrade OpenTelemetry.Instrumentation.Http to version 1.8.1 or higher.
Overview
OpenTelemetry.Instrumentation.Http is a Http instrumentation for OpenTelemetry .NET
Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to the logging of sensitive query parameters by default. This behavior occurs when tracing is enabled, leading to the url.full attribute/tag being written on spans (Activity) for outgoing HTTP requests and the url.query attribute/tag for incoming HTTP requests. As a result, sensitive information such as End User Identifiable Information (EUII), credentials, etc., may be leaked into telemetry backends, potentially causing privacy and/or security incidents.
Note
Older versions of OpenTelemetry.Instrumentation.Http & OpenTelemetry.Instrumentation.AspNetCore may use different tag names but have the same vulnerability.