Improper Input Validation Affecting go.temporal.io/server/service/history package, versions <1.20.5 >=1.21.0 <1.21.6 >=1.22.0 <1.22.7
Threat Intelligence
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GOTEMPORALIOSERVERSERVICEHISTORY-6567185
- published 15 Apr 2024
- disclosed 4 Apr 2024
- credit Unknown
How to fix?
Upgrade go.temporal.io/server/service/history to version 1.20.5, 1.21.6, 1.22.7 or higher.
Overview
Affected versions of this package are vulnerable to Improper Input Validation due to the submission of an invalid UTF-8 string by an authenticated user with permissions to interact with workflows. This can potentially trigger a crashloop. If not addressed, the task with the invalid UTF-8 string will remain in the queue, leading to increased queue lag.
Notes:
Version 1.23 is not impacted.
In this context, a user is an operator of Temporal Server.
References
CVSS Scores
version 3.1