{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2689", "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968", "state": "PUBLISHED", "assignerShortName": "Temporal", "dateReserved": "2024-03-19T20:18:51.036Z", "datePublished": "2024-04-03T21:13:31.599Z", "dateUpdated": "2024-08-01T19:18:48.248Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://hub.docker.com/r/temporalio/server", "defaultStatus": "unaffected", "packageName": "temporalio/server", "product": "Temporal Server", "repo": "https://github.com/temporalio/temporal", "vendor": "Temporal Technologies, Inc.", "versions": [{"lessThan": "1.20.5", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "1.21.6", "status": "affected", "version": "1.21.0", "versionType": "semver"}, {"lessThan": "1.22.7", "status": "affected", "version": "1.22.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgba(232, 232, 232, 0.04);\">Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted.&nbsp;In this context, a user is an operator of Temporal Server.</span><br>"}], "value": "Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted.\u00a0In this context, a user is an operator of Temporal Server.\n"}], "impacts": [{"capecId": "CAPEC-131", "descriptions": [{"lang": "en", "value": "CAPEC-131 Resource Leak Exposure"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "61241ed8-fa44-4f23-92db-b8c443751968", "shortName": "Temporal", "dateUpdated": "2024-04-03T21:13:31.599Z"}, "references": [{"tags": ["release-notes"], "url": "https://github.com/temporalio/temporal/releases"}], "source": {"discovery": "INTERNAL"}, "title": "Denial of Service if invalid UTF-8 sent", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2689", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-04T16:14:17.842942Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:29:33.935Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:18:48.248Z"}, "title": "CVE Program Container", "references": [{"tags": ["release-notes", "x_transferred"], "url": "https://github.com/temporalio/temporal/releases"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/temporalio/temporal/releases", "tags": ["release-notes", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:18:48.248Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2689", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-04T16:14:17.842942Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:22.099Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Denial of Service if invalid UTF-8 sent", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-131", "descriptions": [{"lang": "en", "value": "CAPEC-131 Resource Leak Exposure"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/temporalio/temporal", "vendor": "Temporal Technologies, Inc.", "product": "Temporal Server", "versions": [{"status": "affected", "version": "0", "lessThan": "1.20.5", "versionType": "semver"}, {"status": "affected", "version": "1.21.0", "lessThan": "1.21.6", "versionType": "semver"}, {"status": "affected", "version": "1.22.0", "lessThan": "1.22.7", "versionType": "semver"}], "packageName": "temporalio/server", "collectionURL": "https://hub.docker.com/r/temporalio/server", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/temporalio/temporal/releases", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted.\u00a0In this context, a user is an operator of Temporal Server.\n", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgba(232, 232, 232, 0.04);\">Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted.&nbsp;In this context, a user is an operator of Temporal Server.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "61241ed8-fa44-4f23-92db-b8c443751968", "shortName": "Temporal", "dateUpdated": "2024-04-03T21:13:31.599Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2689", "state": "PUBLISHED", "dateUpdated": "2024-08-01T19:18:48.248Z", "dateReserved": "2024-03-19T20:18:51.036Z", "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968", "datePublished": "2024-04-03T21:13:31.599Z", "assignerShortName": "Temporal"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted.\u00a0In this context, a user is an operator of Temporal Server.\n"}, {"lang": "es", "value": "La denegaci\u00f3n de servicio en Temporal Server anterior a las versiones 1.20.5, 1.21.6 y 1.22.7 permite que un usuario autenticado que tenga permisos para interactuar con flujos de trabajo y haya creado una cadena UTF-8 no v\u00e1lida para su env\u00edo pueda provocar un bucle de bloqueo. Si no se marca, la tarea que contiene el UTF-8 no v\u00e1lido quedar\u00e1 atascada en la cola, lo que provocar\u00e1 un aumento en el retraso de la cola. Con el tiempo, todos los procesos que manejan estas colas se atascar\u00e1n y el sistema se quedar\u00e1 sin recursos. El ID del flujo de trabajo de la tarea fallida ser\u00e1 visible en los registros y se puede utilizar para eliminar ese flujo de trabajo como mitigaci\u00f3n. La versi\u00f3n 1.23 no se ve afectada. En este contexto, un usuario es un operador de Temporal Server."}], "id": "CVE-2024-2689", "lastModified": "2024-04-04T12:48:41.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "security@temporal.io", "type": "Secondary"}]}, "published": "2024-04-03T22:15:07.290", "references": [{"source": "security@temporal.io", "url": "https://github.com/temporalio/temporal/releases"}], "sourceIdentifier": "security@temporal.io", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@temporal.io", "type": "Secondary"}]}

{}