OpenTelemetry-Go versions >=1.15.0 and <1.43.0 contain an untrusted search path vulnerability (CWE-426) related to the use of the kenv command on BSD and Solaris platforms. While the Darwin ioreg command was fixed in a prior CVE, the kenv command remained vulnerable due to being called without an absolute path. This allows a local attacker to hijack the PATH environment variable and achieve arbitrary code execution or privilege escalation. The vulnerability affects system integrity and confidentiality. The issue is fixed in version 1.43.0. Red Hat advisory confirms the vulnerability and notes it does not directly affect RHEL but may impact layered products that include the vulnerable component.

A local attacker on BSD or Solaris systems can exploit this vulnerability by manipulating the PATH environment variable to execute arbitrary code or escalate privileges. This compromises system integrity, confidentiality, and availability. The vulnerability does not affect Red Hat Enterprise Linux directly but may affect Red Hat products that bundle the vulnerable OpenTelemetry-Go component. No active exploits have been reported.

A fix is available in open-telemetry opentelemetry-go version 1.43.0. Users should upgrade to this version or later to remediate the vulnerability. For affected Red Hat products that include this component, monitor vendor advisories for patches or updates. No alternative mitigations are specified by the vendor advisory.