There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose
    delivery stream messages and parsing the records received based on the configured record type.
    `awsfirehosereceiver` allows unauthenticated remote requests, even when configured to require a key.
    OpenTelemetry Collector can be configured to receive CloudWatch metrics via an AWS Firehose Stream.
    Firehose sets the header `X-Amz-Firehose-Access-Key` with an arbitrary configured string. The
    OpenTelemetry Collector awsfirehosereceiver can optionally be configured to require this key on incoming
    requests. However, when this is configured it **still accepts incoming requests with no key**. Only
    OpenTelemetry Collector users configured with the “alpha” `awsfirehosereceiver` module are affected. This
    module was added in version v0.49.0 of the “Contrib” distribution (or may be included in custom builds).
    There is a risk of unauthorized users writing metrics. Carefully crafted metrics could hide other
    malicious activity. There is no risk of exfiltrating data. It’s likely these endpoints will be exposed to
    the public internet, as Firehose does not support private HTTP endpoints. A fix was introduced in PR
    #34847 and released with v0.108.0. All users are advised to upgrade. There are no known workarounds for
    this vulnerability. (CVE-2024-45043)

遠端主機上執行的 OpenTelemetry Collector 版本低於 0.108.0，因此會受到如下計時差異弱點影響：

OpenTelemetry Collector 模組 awsfirehosereceiver 允許未經驗證的遠端要求，即使設定為需要金鑰亦然。

OpenTelemetry Collector 可設定為透過 AWS Firehose 資料流接收 CloudWatch 指標。Firehose 以任意設定的字串設定標頭 X-Amz-Firehose-Access-Key。OpenTelemetry Collector awsfirehosereceiver 可以選擇性設定為在傳入要求時要求此金鑰，但在如此設定後，它仍會接受沒有金鑰的傳入要求。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程主机上运行的 OpenTelemetry Collector 版本低于 0.108.0。因此，受到概述如下的时序差异漏洞影响：

OpenTelemetry Collector 模块 awsfirehosereceiver 允许未经身份验证的远程请求，即使配置为需要密钥也是如此。

OpenTelemetry Collector 可配置为通过 AWS Firehose Stream 接收 CloudWatch 指标。Firehose 使用任意已配置字符串设置标头 X-Amz-Firehose-Access-Key。可以选择将 OpenTelemetry Collector awsfirehosereceiver 配置为在传入请求时需要此密钥。不过，当进行此配置时，它仍会接受没有密钥的传入请求。

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

リモートホストで実行されている OpenTelemetry Collector は、0.108.0 より前のバージョンです。したがって、以下に概説するタイミング不一致の脆弱性の影響を受けます。

OpenTelemetry Collector モジュール awsfirehosereceiver は、キーを要求するように設定されている場合でも、認証されていないリモートリクエストを許可します。

OpenTelemetry Collector は、AWS Firehose Stream を介して CloudWatch メトリクスを受信するように設定できます。Firehose は、ヘッダー X-Amz-Firehose-Access-Key に設定済みの任意の文字列を設定します。OpenTelemetry コレクターの awsfirehosereceiver は、受信リクエストでこのキーを要求するようにオプションで設定できます。ただし、これが設定されている場合でも、キーのない着信リクエストは受け入れられます。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The OpenTelemetry Collector running on the remote host is prior to 0.108.0. It is, therefore, affected by a timing discrepancy vulnerability, outlined below:

OpenTelemetry Collector module awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key.

OpenTelemetry Collector can be configured to receive CloudWatch metrics via an AWS Firehose Stream. Firehose sets the header X-Amz-Firehose-Access-Key with an arbitrary configured string. The OpenTelemetry Collector awsfirehosereceiver can optionally be configured to require this key on incoming requests. However, when this is configured it still accepts incoming requests with no key.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
417685	SCA: security update for github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver (GHSA-prf6-xjxh-p698)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	medium
417685	SCA: security update for github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver (GHSA-prf6-xjxh-p698)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	medium
206657	OpenTelemetry Collector < 0.108.0 驗證繞過	Nessus	Misc.	2024/9/5	2024/9/6	medium
206657	OpenTelemetry Collector < 0.108.0 认证绕过	Nessus	Misc.	2024/9/5	2024/9/6	medium
206657	OpenTelemetry Collector < 0.108.0 の認証バイパス	Nessus	Misc.	2024/9/5	2024/9/6	medium
206657	OpenTelemetry Collector < 0.108.0 Authentication Bypass	Nessus	Misc.	2024/9/5	2024/9/6	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium