Vulnerability in opentelemetry-exporter-otlp-proto-http

[ Description ]Official description

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/open-telemetry/opentelemetry-python/blob/v1.44.0/exporter/opentelemetry-expo…
• github.com/open-telemetry/opentelemetry-python/blob/v1.44.0/exporter/opentelemetry-expo…
• github.com/open-telemetry/opentelemetry-python/commit/89cc68b9ea7e15969b4f042d63397bdc7…
• github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.0
• www.vulncheck.com/advisories/opentelemetry-opentelemetry-exporter-otlp-proto-http-1.5.0…