pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
### Impact Some API endpoints under /.pomerium/ do not verify parameters with pomerium_signature. This could allow modifying parameters intended to be trusted to Pomerium. The issue mainly affects routes responsible for sign in/out, but does not introduce an authentication bypass. ### Specific Go Packages Affected github.com/pomerium/pomerium/authenticate ### Patches Patched in v0.13.4 ### For more information If you have any questions or comments about this advisory * Open an issue in [pomerium](http://github.com/pomerium/pomerium) * Email us at [security@pomerium.com](mailto:security@pomerium.com)
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-29652US | medium6.1 | — | ||
Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan