TechPrufer
Get started
Temporal
Temporal logoTemporal · Feature trail

CVE Numbering Authority Program

1 post · Jul 2023

What this trail covers

Temporal has become a CVE Numbering Authority (CNA), enabling the company to assign CVE identifiers to vulnerabilities in its software. This initiative enhances transparency and security for users of Temporal Server and Temporal Cloud. A specific vulnerability (CVE-2023-3485) related to namespace protection in self-hosted Temporal Server was addressed in version 1.20.0, with a configuration option available in earlier versions to mitigate the risk.

All Temporal trails
  1. Temporal is now a CVE Numbering Authority (CNA)This post announces Temporal's attainment of CVE Numbering Authority (CNA) status, enhancing security transparency. It details a specific vulnerability (CVE-2023-3485) found in self-hosted Temporal Server related to namespace protection bypass due to default configuration. The post explains the vulnerability's impact, the fix in Temporal version 1.20.0, and a workaround for earlier versions (_frontend.enableTokenNamespaceEnforcement_ setting). Temporal Cloud was unaffected.