From 5fcca95b7eeb1928675fa4d355112b8b1c458d0d Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 12 Feb 2025 19:39:19 +0000
Subject: [PATCH] Publish GHSA-q9w6-cwj4-gf4p

---
 .../GHSA-q9w6-cwj4-gf4p.json                  | 39 ++++++++++++++++---
 1 file changed, 34 insertions(+), 5 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2025/02/GHSA-q9w6-cwj4-gf4p/GHSA-q9w6-cwj4-gf4p.json (65%)

diff --git a/advisories/unreviewed/2025/02/GHSA-q9w6-cwj4-gf4p/GHSA-q9w6-cwj4-gf4p.json b/advisories/github-reviewed/2025/02/GHSA-q9w6-cwj4-gf4p/GHSA-q9w6-cwj4-gf4p.json
similarity index 65%
rename from advisories/unreviewed/2025/02/GHSA-q9w6-cwj4-gf4p/GHSA-q9w6-cwj4-gf4p.json
rename to advisories/github-reviewed/2025/02/GHSA-q9w6-cwj4-gf4p/GHSA-q9w6-cwj4-gf4p.json
index 784cdb55a71..cc294ab3052 100644
--- a/advisories/unreviewed/2025/02/GHSA-q9w6-cwj4-gf4p/GHSA-q9w6-cwj4-gf4p.json
+++ b/advisories/github-reviewed/2025/02/GHSA-q9w6-cwj4-gf4p/GHSA-q9w6-cwj4-gf4p.json
@@ -1,24 +1,53 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-q9w6-cwj4-gf4p",
-  "modified": "2025-02-12T03:31:14Z",
+  "modified": "2025-02-12T19:37:52Z",
   "published": "2025-02-12T03:31:14Z",
   "aliases": [
     "CVE-2025-1243"
   ],
+  "summary": "Unencrypted transmission in Temporal api-go library",
   "details": "The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the `update response` field not having Data Converter transformations (e.g. encryption) applied. This is an issue only when using the UpdateWorkflowExecution APIs (released on 13th January 2025)  with a proxy leveraging the api-go library before version 1.44.1.\n\nOther data fields were correctly sent to Data Converter. This issue does not impact the Data Converter server. Data was encrypted in transit. Temporal Cloud services are not impacted.",
   "severity": [
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "go.temporal.io/api"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.44.1"
+            }
+          ]
+        }
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1243"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/temporalio/api-go/commit/dad8b169ada911d3778e070484d1ae78a58bd22b"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/temporalio/api-go"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/temporalio/api-go/releases/tag/v1.44.1"
@@ -33,8 +62,8 @@
       "CWE-311"
     ],
     "severity": "LOW",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-12T19:37:52Z",
     "nvd_published_at": "2025-02-12T01:15:09Z"
   }
 }
\ No newline at end of file