Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZ2ODItcjhxdi1jaDR2

pomerium_signature is not verified in middleware in github.com/pomerium/pomerium

Impact

Some API endpoints under /.pomerium/ do not verify parameters with pomerium_signature. This could allow modifying parameters intended to be trusted to Pomerium.

The issue mainly affects routes responsible for sign in/out, but does not introduce an authentication bypass.

Specific Go Packages Affected

github.com/pomerium/pomerium/authenticate

Patches

Patched in v0.13.4

For more information

If you have any questions or comments about this advisory

• Open an issue in pomerium
• Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-fv82-r8qv-ch4v
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZ2ODItcjhxdi1jaDR2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 3 years ago
Updated: 7 months ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-fv82-r8qv-ch4v, CVE-2021-29652
References:

• https://github.com/pomerium/pomerium/security/advisories/GHSA-fv82-r8qv-ch4v
• https://nvd.nist.gov/vuln/detail/CVE-2021-29652
• https://github.com/pomerium/pomerium/pull/2048
• https://github.com/advisories/GHSA-fv82-r8qv-ch4v

Repository: https://github.com/pomerium/pomerium
Blast Radius: 4.3

Affected Packages