CVE-2022-24797

CVE-2022-24797 affects Pomerium in distributed service mode, where the Authenticate service exposes pprof debug and Prometheus metrics endpoints to untrusted traffic. This can leak environmental information and cause limited denial of service. The issue is fixed in v0.17.1. Workarounds include bl...

GO-2021-0258 Incorrect authorization in github.com/pomerium/pomerium

Pomerium is an open source identity-aware access proxy. Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowedidpclaims as part of policy. If using allowedidpclaims and a user's claims are changed, Pomerium can make incorrect authorizati...

Authorization

Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowedidpclaims as part of policy. If using allowedidpclaims and a user's claims are changed, Pomerium can make...

CVE-2021-41230

Pomerium (open source identity-aware access proxy) is affected when using allowed_idp_claims: changes to a user’s OIDC claims after initial login may not be reflected in policy evaluation, causing incorrect authorization decisions. The issue has been fixed in v0.15.6. For users who cannot upgrade...

Teleport授权问题漏洞

Teleport is an identity-aware, multi-protocol access agent from Teleport USA, Inc. Used by engineers and security professionals to unify access to SSH servers, Kubernetes clusters, web applications, and databases across all environments, Teleport suffers from an authorization issue vulnerability...

Teleport 安全漏洞

Teleport is an identity-aware, multi-protocol access agent from Teleport USA, Inc. Used by engineers and security professionals to unify access to SSH servers, Kubernetes clusters, web applications, and databases across all environments, Teleport has a security vulnerability that could be exploit...

CVE-2021-39162

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted upstream servers. 0.15.1 contains an upgraded envoy binary...

CVE-2021-39204

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versio...

Design/Logic Flaw

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted upstream servers. 0.15.1 contains an upgraded envoy binary...

Design/Logic Flaw

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versio...

CVE-2021-39206

CVE-2021-39206 references Envoy vulnerabilities CVE-2021-32777 and CVE-2021-32779 within Pomerium. The issue can lead to incorrect authorization or routing decisions when path-prefix policy is used. Pomerium has patched Envoy in v0.14.8 and v0.15.1; mitigation also includes removing path-prefix p...

CVE-2021-39204

CVE-2021-39204 affects Pomerium (Envoy-based) where resetting HTTP/2 streams with excessive complexity can cause high CPU utilization and DoS. Affected versions include prior releases; remediation is to upgrade to Envoy-enabled binaries as used in Pomerium 0.14.8 and 0.15.1, which patch this vuln...

CVE-2021-39162

CVE-2021-39162 affects Pomerium via its Envoy-based upstream processing. An H2 GOAWAY plus SETTINGS frame received in the same IO event can cause Envoy to terminate abnormally, leading to DoS when untrusted upstreams are present. The mitigation/patch is in version 0.15.1 (Envoy upgrade). If only ...

Why Zero Trust Needs the Edge

Backhauling traffic destroys performance, and backhauling attack traffic can destroy even more. Nevertheless, in a traditional security deployment model, we are faced with the lose-lose options of either backhauling all traffic to the security stack or allowing some accesses to not go through the...

Akamai Identified as a Leader Among Zero Trust Providers by Independent Research Firm

We are pleased to share that Akamai has been identified as a Leader in The Forrester Wave™: Zero Trust eXtended Ecosystem Platform Providers, Q4 2019. In the report, Forrester evaluated how each vendor's portfolio maps and delivers on specific components of the Zero Trust eXtended ZTX framework...

Why Identity Aware Proxies are Key to Adaptive Access Controls

By now, you have likely heard the term "Zero Trust". From tech seminars and industry events to webinars and whitepapers, it is popping up everywhere. CISOs and CTOs are constantly inundated with calls and messages from different vendors proclaiming different ways their solutions can help them...

Intercept SaaS Services with the Akamai EAA Client

I was quite fortunate to visit Tokyo for the first time last year, and it was an unforgettable experience to explore all the sights and sounds around the Ginza district and to interact with the very friendly Japanese people. It wasn't all play, though -- and I had to get some real work done as...

Does Zero Trust Security Have to be Hard to be Effective?

The short answer is no. As expected, the long answer is a little more nuanced. But first, a quick refresher on Zero Trust security for those who haven't jumped on the bandwagon yet. For those who have, feel free to skip the next section. Zero Trust Security Recap We know that the defensible netwo...

Akamai Identified As A Strong Performer Among Zero Trust eXtended Ecosystem Providers By Independent Research Firm

We are pleased to share that today Akamai has been cited as a Strong Performer in The Forrester Wave™: Zero Trust eXtended Ecosystem Providers, Q4 2018 evaluation. In the report, Forrester evaluated how each vendor's portfolio maps and delivers on specific components of the ZTX framework. Akamai...

Zero Trust Security Architectures - Akamai's Approach

This is Part 5 of a 5 part blog series. Jump to Part 1: Introduction Jump to Part 2: Network Micro-Segmentation Jump to Part 3: Software Defined Perimeter Jump to Part 4: Identity Aware Proxy Introduction In the first part of this blog series, we covered an overview of zero trust architecture...