CVE-2024-2689

{"id": "CVE-2024-2689", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@temporal.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.7}]}, "published": "2024-04-03T22:15:07.290", "references": [{"url": "https://github.com/temporalio/temporal/releases", "source": "security@temporal.io"}, {"url": "https://github.com/temporalio/temporal/releases", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@temporal.io", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted.\u00a0In this context, a user is an operator of Temporal Server.\n"}, {"lang": "es", "value": "La denegaci\u00f3n de servicio en Temporal Server anterior a las versiones 1.20.5, 1.21.6 y 1.22.7 permite que un usuario autenticado que tenga permisos para interactuar con flujos de trabajo y haya creado una cadena UTF-8 no v\u00e1lida para su env\u00edo pueda provocar un bucle de bloqueo. Si no se marca, la tarea que contiene el UTF-8 no v\u00e1lido quedar\u00e1 atascada en la cola, lo que provocar\u00e1 un aumento en el retraso de la cola. Con el tiempo, todos los procesos que manejan estas colas se atascar\u00e1n y el sistema se quedar\u00e1 sin recursos. El ID del flujo de trabajo de la tarea fallida ser\u00e1 visible en los registros y se puede utilizar para eliminar ese flujo de trabajo como mitigaci\u00f3n. La versi\u00f3n 1.23 no se ve afectada. En este contexto, un usuario es un operador de Temporal Server."}], "lastModified": "2024-11-21T09:10:17.947", "sourceIdentifier": "security@temporal.io"}