Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- open-telemetry opentelemetry-js-contrib
fixed in 27e172a9e0d549559056ccd58f27d13467454156
- @opentelemetry instrumentation-cassandra-driver
fixed in 0.66.0
- @opentelemetry instrumentation-knex
fixed in 0.65.0
- @opentelemetry instrumentation-mongoose
fixed in 0.67.0
- @opentelemetry instrumentation-mysql
fixed in 0.67.0
- @opentelemetry instrumentation-mysql2
fixed in 0.67.0
- @opentelemetry instrumentation-oracledb
fixed in 0.46.0
- @opentelemetry instrumentation-pg
fixed in 0.73.0
- @opentelemetry instrumentation-tedious
fixed in 0.40.0
- @opentelemetry/instrumentation-cassandra-drivernpm
fixed in 0.66.0
- @opentelemetry/instrumentation-tediousnpm
fixed in 0.40.0
- @opentelemetry/instrumentation-oracledbnpm
fixed in 0.46.0
- @opentelemetry/instrumentation-mongoosenpm
fixed in 0.67.0
- @opentelemetry/instrumentation-mysqlnpm
fixed in 0.67.0
- @opentelemetry/instrumentation-knexnpm
fixed in 0.65.0
- @opentelemetry/instrumentation-mysql2npm
fixed in 0.67.0
- @opentelemetry/instrumentation-pgnpm
fixed in 0.73.0