Threats Tagged 'ghsa-8wmf-6v46-5gfg'

OpenTelemetry-Go versions from 1.5.0 up to but not including 1.45.0 emit an internal Info-level diagnostic event that logs detailed configuration information including span processor, exporter, and client settings. When applications enable OpenTelemetry internal Info logging via otel.SetLogger, sensitive information such as OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and full Zipkin collector URLs (which may contain credentials or tokens) can be exposed in logs. The default logger does not emit this event, and authentication headers, TLS keys, and span payloads are not logged. This vulnerability is fixed in version 1.45.0.