PT-2024-21562 · Unknown · Temporal Server
Published
2024-04-03
·
Updated
2024-06-04
·
CVE-2024-2689
CVSS v3.1
4.4
Medium
| Vector | AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Temporal Server versions prior to 1.20.5
Temporal Server versions prior to 1.21.6
Temporal Server versions prior to 1.22.7
Description
The issue allows an authenticated user with permissions to interact with workflows to potentially cause a crashloop by submitting an invalid UTF-8 string. This can lead to a task becoming stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck, and the system will run out of resources. The workflow ID of the failing task is visible in the logs and can be used to remove that workflow as a mitigation.
Recommendations
For versions prior to 1.20.5, consider removing the workflow with the failing task ID from the logs to mitigate the issue.
For versions prior to 1.21.6, consider removing the workflow with the failing task ID from the logs to mitigate the issue.
For versions prior to 1.22.7, consider removing the workflow with the failing task ID from the logs to mitigate the issue.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Temporal Server