OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
opentelemetry-js-contrib
Vendor
open-telemetry
Product
opentelemetry-js-contrib
Platforms
Unknown
Default status
Unknown
opentelemetry-js-contrib · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 27e172a9e0d549559056ccd58f27d13467454156
affected
Unavailable
Unavailable
Unavailable
None listed
instrumentation-cassandra-driver
Vendor
@opentelemetry
Product
instrumentation-cassandra-driver
Platforms
Unknown
Default status
Unknown
instrumentation-cassandra-driver · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.66.0
affected
Unavailable
Unavailable
Unavailable
None listed
instrumentation-knex
Vendor
@opentelemetry
Product
instrumentation-knex
Platforms
Unknown
Default status
Unknown
instrumentation-knex · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.65.0
affected
Unavailable
Unavailable
Unavailable
None listed
instrumentation-mongoose
Vendor
@opentelemetry
Product
instrumentation-mongoose
Platforms
Unknown
Default status
Unknown
instrumentation-mongoose · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.67.0
affected
Unavailable
Unavailable
Unavailable
None listed
instrumentation-mysql
Vendor
@opentelemetry
Product
instrumentation-mysql
Platforms
Unknown
Default status
Unknown
instrumentation-mysql · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.67.0
affected
Unavailable
Unavailable
Unavailable
None listed
instrumentation-mysql2
Vendor
@opentelemetry
Product
instrumentation-mysql2
Platforms
Unknown
Default status
Unknown
instrumentation-mysql2 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.67.0
affected
Unavailable
Unavailable
Unavailable
None listed
instrumentation-oracledb
Vendor
@opentelemetry
Product
instrumentation-oracledb
Platforms
Unknown
Default status
Unknown
instrumentation-oracledb · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.46.0
affected
Unavailable
Unavailable
Unavailable
None listed
instrumentation-pg
Vendor
@opentelemetry
Product
instrumentation-pg
Platforms
Unknown
Default status
Unknown
instrumentation-pg · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
< 0.73.0
affected
Unavailable
Unavailable
Unavailable
None listed
instrumentation-tedious
Vendor
@opentelemetry
Product
instrumentation-tedious
Platforms
Unknown
Default status
Unknown
instrumentation-tedious · Scoped product and version facts