CVE-2023-39951 Information disclosure in opentelemetry-java-instrumentation
OpenTelemetry Java Instrumentation leaks email content to telemetry backends when instrumenting AWS SES v1 API calls, exposing sensitive data to unintended audiences.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-39951?
CVE-2023-39951 is a medium-severity vulnerability in open-telemetry opentelemetry-java-instrumentation, published on 8 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. OpenTelemetry Java Instrumentation prior to version 1.28.0 contains an issue related to the instrumentation of Java applications using the AWS SDK v2 with Amazon Simple Email Service (SES) v1 API. When SES POST requests are instrumented, the query parameters of the request are inserted into the trace `url.path` field. This behavior leads to the http body, containing the email subject and message, to be present in the trace request url metadata. Any user using a version before 1.28.0 of OpenTelemetry Java Instrumentation to instrument AWS SDK v2 call to SES’s v1 SendEmail API is affected. The e-mail content sent to SES may end up in telemetry backend. This exposes the e-mail content to unintended audiences. The issue can be mitigated by updating OpenTelemetry Java Instrumentation to version 1.28.0 or later.
Weakness: CWE-200
Which versions are affected by CVE-2023-39951?
It affects 1 product.
Products include Linuxfoundation Opentelemetry Instrumentation for Java.
How do I fix CVE-2023-39951?
No fix has been published for CVE-2023-39951 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-39951 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39951 exists.
Other vulnerabilities in open-telemetry opentelemetry-java-instrumentation
- CVE-2026-33701 OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
- CVE-2026-54704 OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
- CVE-2026-54712 OpenTelemetry Javaagent RMI context propagation allows resource exhaustion
Sources
Also known as GHSA-hghr-r469-gfq6.