~ / search / GHSA-pvrc-wvj2-f59p

GHSA-pvrc-wvj2-f59p

Pomerium vulnerable to Incorrect Authorization with specially crafted requests

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-33189

Packages

EcosystemPackageAffectedFixed in
Go github.com/pomerium/pomerium >= 0.22.0, < 0.22.2 0.22.2
Go github.com/pomerium/pomerium >= 0.21.0, < 0.21.4 0.21.4
Go github.com/pomerium/pomerium >= 0.20.0, < 0.20.1 0.20.1
Go github.com/pomerium/pomerium >= 0.19.0, < 0.19.2 0.19.2
Go github.com/pomerium/pomerium >= 0.18.0, < 0.18.1 0.18.1
Go github.com/pomerium/pomerium < 0.17.4 0.17.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact With specially crafted requests, incorrect authorization decisions may be made by Pomerium. ### Patches We are releasing patch fixes to address this vulnerability going back to `v0.17.X`. Please upgrade to: - v0.22.2 - v0.21.4 - v0.20.1 - v0.19.2 - v0.18.1 - v0.17.4 ### For more information If you have any questions or comments about this advisory: - Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues) - Email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.