Vulnerability in Temporal API-Go Library Affects gRPC Proxy Implementation

CVE-2025-1243

What is CVE-2025-1243?

In the Temporal API-Go library, versions prior to 1.44.1 exhibited a vulnerability where update response information was not sent to the Data Converter when utilizing the proxy package in a gRPC proxy setup. This flaw meant that crucial transformations, such as encryption, were not applied to the update response field during the execution of the UpdateWorkflowExecution APIs, designated for launch on January 13, 2025. While other data fields were successfully transmitted with appropriate transformations, this issue is specific to the UpdateWorkflowExecution process and does not affect the Data Converter server, as data was encrypted in transit. Temporal Cloud services remain unaffected.

References