Package
wazuh-dashboard-fips
Component
@opentelemetry/core
Latest update
5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
This CVE affects @opentelemetry/core before 2.8.0. In wazuh-dashboard it is a transitive dependency of elastic-apm-node 3.52.2, which is built on the OpenTelemetry 1.x line; @opentelemetry/sdk-metrics 1.30.1 pins @opentelemetry/core to exactly 1.30.1. The fix ships only on the 2.x line, consumable only through elastic-apm-node 4.x — no fix exists in the 1.x line wazuh-dashboard depends on. Remediation therefore requires upstream to adopt elastic-apm-node 4.x; until then the CVE cannot be resolved here without an unsupported major APM-agent migration.
Status