pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
### Impact Some API endpoints under /.pomerium/ do not verify parameters with pomerium_signature. This could allow modifying parameters intended to be trusted to Pomerium. The issue mainly affects routes responsible for sign in/out, but does not introduce an authentication bypass. ### Specific Go Packages Affected github.com/pomerium/pomerium/authenticate ### Patches Patched in v0.13.4 ### For more information If you have any questions or comments about this advisory * Open an issue in [pomerium](http://github.com/pomerium/pomerium) * Email us at [security@pomerium.com](mailto:security@pomerium.com)
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-29652US | medium6.1 | — | ||
Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process | ||||
references
External citations — patches, advisories, analysis.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan