QID 981066

QID 981066: Go (go) Security Update for github.com/pomerium/pomerium (GHSA-cfc2-wjcm-c8fm)

Envoy, which Pomerium is based on, contains two authorization related vulnerabilities:

- [CVE-2021-32777](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32779): incorrectly transform a URL containing a `#fragment` element, causing a mismatch in path-prefix based authorization decisions.
- [CVE-2021-32779](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32777): incorrectly handle duplicate headers, dropping all but the last. This may lead to incorrect routing or authorization policy decisions.

With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium.

CVSS V3 rated as Critical - 8.6 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched.Workaround:
- This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.

Vendor References

GHSA-cfc2-wjcm-c8fm - github.com/advisories/GHSA-cfc2-wjcm-c8fm

CVEs related to QID 981066

CVE-2021-39206 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-cfc2-wjcm-c8fm	github.com/pomerium/pomerium		github.com/advisories/GHSA-cfc2-wjcm-c8fm

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].