6.5
Moyenne
CVE-2026-54704 OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java
Description
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| opentelemetry-java-instrumentation 2.28 | premières → < 2.28.0 | 2.28.0 |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de opentelemetry-java-instrumentation
Les 4 CVE de opentelemetry-java-instrumentation →
CVE-2026-54712
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java
5.3
Moyenne
CVE-2026-33701
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java
9.3
Critique
CVE-2023-39951
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java
6.5
Moyenne