Prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent.

The docker and containerd packages on Amazon Linux are not affected by CVE-2023-47108. Some static analysis tools report that CVE-2023-47108 affects containerd and docker. This is based on both packages being statically compiled with the otelgrpc Go module referenced by CVE-2023-47108. Neither package is affected by CVE-2023-47108 because taking advantage of the affected code requires administrator privileges in both cases.

Docker uses the otelgrpc module for OpenTelemetry tracing through BuildKit. Accessing the endpoint requires administrator privileges to use the Docker Engine remote API. Similarly, the containerd’s gRPC endpoint is only exposed through a local Unix socket and also requires administrator access.