fix(deps): update module go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to v0.46.0 [security]

[plural-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	require	minor	v0.42.0 -> v0.46.0

GitHub Vulnerability Alerts

CVE-2023-47108

Summary

The grpc Unary Server Interceptor opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go

// UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable
// for use in a grpc.NewServer call.
func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor {

out of the box adds labels

• net.peer.sock.addr
• net.peer.sock.port

that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent.

Details

An attacker can easily flood the peer address and port for requests.

PoC

Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it.

Impact

In order to be affected, the program has to configure a metrics pipeline, use UnaryServerInterceptor, and does not filter any client IP address and ports via middleware or proxies, etc.

Others

It is similar to already reported vulnerabilities.

• GHSA-rcjv-mgp8-qvmr (open-telemetry/opentelemetry-go-contrib)

• GHSA-5r5m-65gx-7vrh (open-telemetry/opentelemetry-go-contrib)
• GHSA-cg3q-j54f-5p7p (prometheus/client_golang)

Workaround for affected versions

As a workaround to stop being affected, a view removing the attributes can be used.

The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

Solution provided by upgrading

In PR #​4322, to be released with v0.46.0, the attributes were removed.

References

• #​4322

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[plural-renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: downloading github.com/ory/hydra-client-go/v2 v2.1.1
go: downloading github.com/ory/kratos-client-go v0.13.1
go: downloading github.com/pluralsh/trace-shield-controller v0.3.24
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.0
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.42.0
go: downloading go.opentelemetry.io/contrib v1.16.1
go: downloading go.opentelemetry.io/otel v1.20.0
go: downloading go.opentelemetry.io/otel/trace v1.20.0
go: downloading github.com/99designs/gqlgen v0.17.34
go: downloading github.com/go-chi/chi/v5 v5.0.8
go: downloading github.com/ravilushqa/otelgqlgen v0.13.1
go: downloading github.com/rs/cors v1.9.0
go: downloading go.opentelemetry.io/contrib/propagators/b3 v1.17.0
go: downloading go.opentelemetry.io/contrib/propagators/jaeger v1.17.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.16.0
go: downloading github.com/vektah/gqlparser/v2 v2.5.6
go: downloading github.com/go-chi/render v1.0.2
go: downloading github.com/ory/herodot v0.10.2
go: downloading go.opentelemetry.io/otel/metric v1.20.0
go: downloading github.com/urfave/cli/v2 v2.25.7
go: downloading go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0
go: downloading github.com/ajg/form v1.5.1
go: downloading google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d
go: downloading github.com/hashicorp/golang-lru/v2 v2.0.3
go: downloading github.com/jandelgado/gcov2lcov v1.0.5
go: downloading github.com/ory/go-acc v0.2.9-0.20230103102148-6b1c9a70dbbe
go: downloading github.com/grpc-ecosystem/grpc-gateway/v2 v2.12.0
go: downloading github.com/agnivade/levenshtein v1.1.1
go: downloading github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d
go: downloading github.com/pelletier/go-toml/v2 v2.0.7
go: downloading go.opentelemetry.io v0.1.0
go: downloading go.opentelemetry.io/otel/exporters/otlp v0.20.1
go: github.com/pluralsh/trace-shield imports
	go.opentelemetry.io/otel/exporters/otlp/otlptrace imports
	go.opentelemetry.io/otel/exporters/otlp/internal: cannot find module providing package go.opentelemetry.io/otel/exporters/otlp/internal
go: github.com/pluralsh/trace-shield imports
	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp imports
	go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig imports
	go.opentelemetry.io/otel/exporters/otlp/internal/envconfig: cannot find module providing package go.opentelemetry.io/otel/exporters/otlp/internal/envconfig