CVE-2024-2689 Denial of Service if invalid UTF-8 sent
An authenticated user can cause a denial of service in Temporal Server by submitting invalid UTF-8 strings, leading to resource exhaustion and system crashes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-2689?
CVE-2024-2689 is a medium-severity denial of service vulnerability in Temporal Server, published on 3 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server.
Weakness: CWE-20
Which versions are affected by CVE-2024-2689?
7 open source packages ship an affected version, including go.temporal.io/server and github.com/temporalio/temporal.
| Package | Affected | Fixed in |
|---|---|---|
go.temporal.io/server Go | All versions | 1.20.5, 1.21.6, 1.22.7 |
github.com/temporalio/temporal Go | All versions | 1.20.5 |
github.com/temporalio/temporal Go | All versions | 1.20.5 |
github.com/temporalio/temporal Go | From 1.21.0 | 1.21.6 |
github.com/temporalio/temporal Go | From 1.21.0 | 1.21.6 |
github.com/temporalio/temporal Go | From 1.22.0-rc1 | 1.22.7 |
1 more packages
github.com/temporalio/temporal Go | From 1.22.0-rc1 | 1.22.7 |
How do I fix CVE-2024-2689?
Upgrade go.temporal.io/server to a fixed version for your release line: 1.20.5, 1.21.6 or 1.22.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-2689 being exploited?
There is no known exploitation of CVE-2024-2689 in the wild and no public exploit code.
Sources
Also known as ECHO-a528-ab14-8bf5, GHSA-wmxc-v39r-p9wf, GO-2024-2689.