CVE-2025-1243
Feb. 12, 2025, 1:15 a.m.
None
No Score
Description
The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the `update response` field not having Data Converter transformations (e.g. encryption) applied. This is an issue only when using the UpdateWorkflowExecution APIs (released on 13th January 2025) with a proxy leveraging the api-go library before version 1.44.1.
Other data fields were correctly sent to Data Converter. This issue does not impact the Data Converter server. Data was encrypted in transit. Temporal Cloud services are not impacted.
Product(s) Impacted
| Product | Versions |
|---|---|
| Temporal api-go library |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-311
Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
Tags
Timeline
Published: Feb. 12, 2025, 1:15 a.m.
Last Modified: Feb. 12, 2025, 1:15 a.m.
Last Modified: Feb. 12, 2025, 1:15 a.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
security@temporal.io
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.