Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/jaegertracing/jaeger

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5GoPublished

    A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

    GHSA-2w8w-qhg4-f78j

    Affected
    • Go github.com/jaegertracing/jaeger < 1.47.0
    Fixed in
    1.47.0· Vendor fix available
    Issue
    Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r Summary Jaeger UI is using the json-markup dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable is vulnerable to XSS. Details The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49 PoC 1. Start a Jaeger UI 2. Save the following trace as a file: 3. Upload that trace to Jaeger UI in order to visualise it. 4. Open the trace, open it's span's attributes. 5. XSS should be fired. Impact This is a XSS on Jaeger UI. XSS can be used to run JavaScript.

    Recommended action: Upgrade to 1.47.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 5.5GoPublished

    Information Exposure in jaeger

    CVE-2020-10750 · GHSA-gh32-pc56-4c96

    Affected
    • Go github.com/jaegertracing/jaeger < 1.18.1
    Fixed in
    1.18.1· Vendor fix available
    Issue
    Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials.

    Recommended action: Upgrade to 1.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →