GHSA-fv82-r8qv-ch4vMediumCVSS 6.1

pomerium_signature is not verified in middleware in github.com/pomerium/pomerium

Published
May 21, 2021
Last Modified
October 2, 2023

🔗 CVE IDs covered (1)

CVE-2021-29652 →

📋 Description

Impact

Some API endpoints under /.pomerium/ do not verify parameters with pomerium_signature. This could allow modifying parameters intended to be trusted to Pomerium.

The issue mainly affects routes responsible for sign in/out, but does not introduce an authentication bypass.

Specific Go Packages Affected

github.com/pomerium/pomerium/authenticate

Patches

Patched in v0.13.4

For more information

If you have any questions or comments about this advisory

🎯 Affected products1

  • go/github.com/pomerium/pomerium:>= 0.10.0, < 0.13.4

🔗 References (4)