JDBC Password Leak in OpenTelemetry Java Instrumentation

Executive Summary

This vulnerability exists in OpenTelemetry Java Instrumentation versions prior to 2.28.0. The JDBC auto-instrumentation feature may fail to properly sanitize passwords in SQL CONNECT statements when the password is enclosed in double quotes. Because of this, clear-text database passwords can be captured and added to trace span attributes, which are then exported to observability backends.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that sensitive database passwords can be exposed in clear text within trace data sent to observability backends. This exposure can lead to unauthorized access to database credentials if the trace data is accessed by malicious actors or improperly secured, potentially compromising database security.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade OpenTelemetry Java Instrumentation to version 2.28.0 or later, where the issue with password sanitization in JDBC auto-instrumentation has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes clear-text database passwords to be included in trace span attributes and exported to observability backends. Such exposure of sensitive authentication credentials can lead to unauthorized access risks and potential data breaches.

Because sensitive information like passwords is exposed, this issue may negatively impact compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and credentials to ensure confidentiality and prevent unauthorized disclosure.

Organizations using affected versions prior to 2.28.0 should upgrade to the fixed version to mitigate this risk and maintain compliance.

Useful 0 Not Useful 0