x/vulndb: potential Go vuln in go.temporal.io/api: GHSA-q9w6-cwj4-gf4p

[GoVulnBot]

Advisory GHSA-q9w6-cwj4-gf4p references a vulnerability in the following Go modules:

Module
go.temporal.io/api

Description:
The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data Converter transformations (e.g. encryption) applied. This is an issue only when using the UpdateWorkflowExecution APIs (released on 13th January 2025) with a proxy leveraging the api-go library before version 1.44.1.

Other data fields were correctly sent to Data Converter. This issue does not impa...

References:

• ADVISORY: GHSA-q9w6-cwj4-gf4p
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2025-1243
• FIX: temporalio/api-go@dad8b16
• WEB: https://github.com/temporalio/api-go/releases/tag/v1.44.1
• WEB: https://temporal.io/blog/announcing-a-new-operation-workflow-update

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: go.temporal.io/api
      versions:
        - fixed: 1.44.1
      vulnerable_at: 1.44.0
summary: Unencrypted transmission in Temporal api-go library in go.temporal.io/api
cves:
    - CVE-2025-1243
ghsas:
    - GHSA-q9w6-cwj4-gf4p
references:
    - advisory: https://github.com/advisories/GHSA-q9w6-cwj4-gf4p
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-1243
    - fix: https://github.com/temporalio/api-go/commit/dad8b169ada911d3778e070484d1ae78a58bd22b
    - web: https://github.com/temporalio/api-go/releases/tag/v1.44.1
    - web: https://temporal.io/blog/announcing-a-new-operation-workflow-update
source:
    id: GHSA-q9w6-cwj4-gf4p
    created: 2025-02-12T20:01:31.812853088Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/652896 mentions this issue: DO_NOT_SUBMIT