GHSA-fv82-r8qv-ch4v
pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/pomerium/pomerium | >= 0.10.0, < 0.13.4 | 0.13.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Some API endpoints under /.pomerium/ do not verify parameters with pomerium_signature. This could allow modifying parameters intended to be trusted to Pomerium.
The issue mainly affects routes responsible for sign in/out, but does not introduce an authentication bypass.
### Specific Go Packages Affected
github.com/pomerium/pomerium/authenticate
### Patches
Patched in v0.13.4
### For more information
If you have any questions or comments about this advisory
* Open an issue in [pomerium](http://github.com/pomerium/pomerium)
* Email us at [[email protected]](mailto:[email protected])
References
External links from the advisory. They lead to third-party sites.