CVE-2024-39315 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page at /.pomerium unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be...

Pomerium Security Breach

Pomerium is an open source identity-aware access agent from Pomerium, Inc. It is used to enable secure access to internal applications. A security vulnerability exists in Pomerium versions prior to 0.26.1, which stems from the presence of a cross-site scripting vulnerability that allows an attack...

PT-2024-28439

Name of the Vulnerable Software and Affected Versions Pomerium versions prior to 0.26.1 Description The Pomerium user info page, located at the /.pomerium endpoint, unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to ...

BIT-ENVOY-2021-39162 Incorrect handling of H2 GOAWAY + SETTINGS frames

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted upstream servers. 0.15.1 contains an upgraded envoy binary...

BIT-ENVOY-2021-39204 Excessive CPU usage in Pomerium

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versio...

BIT-ENVOY-2021-39206 Incorrect Authorization with specially crafted requests

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect...

Authorization Bypass

github.com/pomerium/pomerium is vulnerable to Improper Authorization. The vulnerability exists due to crafted requests which allows an attacker to bypass authorization...

CVE-2023-33189

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2...

Authorization

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2...

CVE-2023-33189 Incorrect Authorization with specially crafted requests

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2...

CVE-2023-33189

CVE-2023-33189 affects Pomerium, an identity and context-aware access proxy. The vulnerability arises from incorrect authorization decisions when handling specially crafted requests, enabling total impact on confidentiality, integrity, and availability per CVSS assessments. Affected versions incl...

CVE-2023-33189 Incorrect Authorization with specially crafted requests

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2...

CVE-2023-33189 Incorrect Authorization with specially crafted requests

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2...

Pomerium 安全漏洞

Pomerium is an open source identity-aware access agent from the U.S. company Pomerium. It is used to enable secure access to internal applications. A security vulnerability exists in Pomerium v0.22.1 and earlier versions that stems from the fact that for specially crafted requests, Pomerium may...

Pomerium vulnerable to Incorrect Authorization with specially crafted requests

Impact With specially crafted requests, incorrect authorization decisions may be made by Pomerium. Patches We are releasing patch fixes to address this vulnerability going back to v0.17.X. Please upgrade to: - v0.22.2 - v0.21.4 - v0.20.1 - v0.19.2 - v0.18.1 - v0.17.4 For more information If you...

GHSA-PVRC-WVJ2-F59P Pomerium vulnerable to Incorrect Authorization with specially crafted requests

Impact With specially crafted requests, incorrect authorization decisions may be made by Pomerium. Patches We are releasing patch fixes to address this vulnerability going back to v0.17.X. Please upgrade to: - v0.22.2 - v0.21.4 - v0.20.1 - v0.19.2 - v0.18.1 - v0.17.4 For more information If you...

PT-2023-24206 · Pomerium · Pomerium

Name of the Vulnerable Software and Affected Versions: Pomerium versions prior to 0.17.4 Pomerium versions prior to 0.18.1 Pomerium versions prior to 0.19.2 Pomerium versions prior to 0.20.1 Pomerium versions prior to 0.21.4 Pomerium versions prior to 0.22.2 Description: Pomerium is an identity a...

CVE-2022-24797

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This...

Design/Logic Flaw

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This...

CVE-2022-24797 Exposure of Sensitive Information in Pomerium

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This...