CVE-2025-1243

Field in api-go proxy not transformed before version 1.44.1

Description

The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the `update response` field not having Data Converter transformations (e.g. encryption) applied. This is an issue only when using the UpdateWorkflowExecution APIs (released on 13th January 2025) with a proxy leveraging the api-go library before version 1.44.1. Other data fields were correctly sent to Data Converter. This issue does not impact the Data Converter server. Data was encrypted in transit. Temporal Cloud services are not impacted.

Remediation

Solution:

  • Upgrade proxy servers leveraging the `api-go` library in your environment to use version 1.44.1 or later of the library.

Category

2.0
CVSS
Severity: Low
CVSS 4.0 •
EPSS 0.00%
Affected: Temporal Technologies, Inc. api-go library
Published at:
Updated at:

References

Link Tags
https://github.com/temporalio/api-go/releases/tag/v1.44.1 release notes
https://temporal.io/blog/announcing-a-new-operation-workflow-update related

Frequently Asked Questions

What is the severity of CVE-2025-1243?
CVE-2025-1243 has been scored as a low severity vulnerability.
How to fix CVE-2025-1243?
To fix CVE-2025-1243: Upgrade proxy servers leveraging the `api-go` library in your environment to use version 1.44.1 or later of the library.
Is CVE-2025-1243 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-1243 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-1243?
CVE-2025-1243 affects Temporal Technologies, Inc. api-go library.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.