Resolve CVE-2023-32731 (#4647)

open-telemetry · Jul 11, 2023 · f95c689 · f95c689
1 parent b23b146
commit f95c689
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -7,7 +7,7 @@
   <ItemGroup>
     <PackageVersion Include="Google.Protobuf" Version="[3.19.4,4.0)" />
     <PackageVersion Include="Grpc" Version="[2.44.0,3.0)" />
-    <PackageVersion Include="Grpc.Net.Client" Version="[2.45.0,3.0)" />
+    <PackageVersion Include="Grpc.Net.Client" Version="[2.52.0,3.0)" />
     <PackageVersion Include="Grpc.Tools" Version="[2.44.0,3.0)" />
     <PackageVersion Include="Microsoft.AspNetCore.Http.Abstractions" Version="[2.1.1,6.0)" />
     <PackageVersion Include="Microsoft.AspNetCore.Http.Features" Version="[2.1.1,6.0)" />

diff --git a/src/OpenTelemetry.Exporter.OpenTelemetryProtocol/CHANGELOG.md b/src/OpenTelemetry.Exporter.OpenTelemetryProtocol/CHANGELOG.md
@@ -14,13 +14,19 @@
   for instructions to enable exemplars.
   ([#4553](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4553))
 
-* Updated Grpc.Net.Client to v2.45 to fix unobserved exception
+* Updated Grpc.Net.Client to `2.45.0` to fix unobserved exception
   from failed calls.
   ([#4573](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4573))
 
 * Updated to support `Severity` and `SeverityText` when exporting `LogRecord`s.
   ([#4568](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4568))
 
+* Updated Grpc.Net.Client to `2.52.0` to address the vulnerability reported by
+  CVE-2023-32731. Refer to
+  [https://github.com/grpc/grpc/pull/32309](https://github.com/grpc/grpc/pull/32309)
+  for more details.
+  ([#4647](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4647))
+
 ## 1.5.1
 
 Released 2023-Jun-26