| id: GO-2025-3462 |
| modules: |
| - module: go.temporal.io/api |
| versions: |
| - fixed: 1.44.1 |
| vulnerable_at: 1.44.0 |
| packages: |
| - package: go.temporal.io/api/proxy |
| symbols: |
| - NewPayloadVisitorInterceptor |
| summary: Unencrypted transmission in Temporal api-go library in go.temporal.io/api |
| cves: |
| - CVE-2025-1243 |
| ghsas: |
| - GHSA-q9w6-cwj4-gf4p |
| references: |
| - advisory: https://github.com/advisories/GHSA-q9w6-cwj4-gf4p |
| - web: https://github.com/temporalio/api-go/commit/dad8b169ada911d3778e070484d1ae78a58bd22b |
| - web: https://github.com/temporalio/api-go/releases/tag/v1.44.1 |
| - web: https://temporal.io/blog/announcing-a-new-operation-workflow-update |
| source: |
| id: GHSA-q9w6-cwj4-gf4p |
| created: 2025-02-26T12:35:57.774107-05:00 |
| review_status: REVIEWED |
