Malformed unicode header values may throw uncaught exception
Medium6.2CVE-2024-38525 · Published Jun 27, 2024
### Summary When the `dd-trace-cpp` library fails to extract trace context due to malformed unicode, the library attempts to log the list of audited headers and their values using the `nlohmann` JSON library. This attempted logging may throw an uncaught exception. ### Details The code that introduced this logging was added in pull request [#72](https://github.com/DataDog/dd-trace-cpp/pull/72) and has been present in versions [v0.1.12](https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.1.12), [v0.2.0](https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.0), and [v0.2.1](https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.1). For each key and value in the list of audited headers, a nlohmann::json instance is created as follows: ``` stream << nlohmann::json(it->first + ": " + it->second); ``` Here, `it->first` is the header name and `it->second` is the value. This code is problematic for several reasons: - An exception can be thrown by the JSON library while parsing the input. - An exception can be thrown by the implicit call to `dump()`. ### Impact This impacts any downstream applications that rely on `dd-trace-cpp` for tracing. ### Patches This vulnerability has...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| dd-trace-cpp Product | < v0.2.2 | v0.2.2 |
Details and references
### Summary When the `dd-trace-cpp` library fails to extract trace context due to malformed unicode, the library attempts to log the list of audited headers and their values using the `nlohmann` JSON library. This attempted logging may throw an uncaught exception. ### Details The code that introduced this logging was added in pull request [#72](https://github.com/DataDog/dd-trace-cpp/pull/72) and has been present in versions [v0.1.12](https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.1.12), [v0.2.0](https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.0), and [v0.2.1](https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.1). For each key and value in the list of audited headers, a nlohmann::json instance is created as follows: ``` stream << nlohmann::json(it->first + ": " + it->second); ``` Here, `it->first` is the header name and `it->second` is the value. This code is problematic for several reasons: - An exception can be thrown by the JSON library while parsing the input. - An exception can be thrown by the implicit call to `dump()`. ### Impact This impacts any downstream applications that rely on `dd-trace-cpp` for tracing. ### Patches This vulnerability has been patched in `dd-trace-cpp` version [v0.2.2](https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.2) (#132) ### Workarounds - Filter out header values that are not valid UTF-8 strings
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
More Datadog advisories
All Datadog| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 5 | Improper parsing of W3C baggage headers may lead to DoS | High7.5 | 3.43.0+1 more |
| Jun 5 | Improper parsing of W3C baggage headers may lead to DoS | High7.5 | 4.8.2 |
| Jun 5 | Improper parsing of W3C baggage headers may lead to DoS | High7.5 | 1.62.0 |
| Jun 5 | Improper parsing of W3C baggage headers may lead to DoS | High7.5 | 1.19.2 |
| Mar 23 | Unsafe deserialization in dd-trace-java RMI instrumentation may lead to remote code execution | Critical9.3 | 1.60.3 |
| Nov 112025 | Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions | High7.0 | 7.71.0 |