« Volver al listado

CVE-2024-2689

Estado: AplazadaMedia (4.4)—

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Temporal — Temporal ServerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-2689",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-2689",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-04T16:14:17.842942Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@temporal.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.7
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.7
      }
    ]
  },
  "affected": [
    {
      "source": "security@temporal.io",
      "affectedData": [
        {
          "repo": "https://github.com/temporalio/temporal",
          "vendor": "Temporal Technologies, Inc.",
          "product": "Temporal Server",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.20.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.21.0",
              "lessThan": "1.21.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.22.0",
              "lessThan": "1.22.7",
              "versionType": "semver"
            }
          ],
          "packageName": "temporalio/server",
          "collectionURL": "https://hub.docker.com/r/temporalio/server",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-04-03T22:15:07.290",
  "references": [
    {
      "url": "https://github.com/temporalio/temporal/releases",
      "source": "security@temporal.io"
    },
    {
      "url": "https://github.com/temporalio/temporal/releases",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@temporal.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server.\n"
    },
    {
      "lang": "es",
      "value": "La denegación de servicio en Temporal Server anterior a las versiones 1.20.5, 1.21.6 y 1.22.7 permite que un usuario autenticado que tenga permisos para interactuar con flujos de trabajo y haya creado una cadena UTF-8 no válida para su envío pueda provocar un bucle de bloqueo. Si no se marca, la tarea que contiene el UTF-8 no válido quedará atascada en la cola, lo que provocará un aumento en el retraso de la cola. Con el tiempo, todos los procesos que manejan estas colas se atascarán y el sistema se quedará sin recursos. El ID del flujo de trabajo de la tarea fallida será visible en los registros y se puede utilizar para eliminar ese flujo de trabajo como mitigación. La versión 1.23 no se ve afectada. En este contexto, un usuario es un operador de Temporal Server."
    }
  ],
  "lastModified": "2026-06-17T07:25:04.073",
  "sourceIdentifier": "security@temporal.io"
}