medium6.1
CVE-2021-29652
pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
Impact
### Impact Some API endpoints under /.pomerium/ do not verify parameters with pomerium_signature. This could allow modifying parameters intended to be trusted to Pomerium. The issue mainly affects routes responsible for sign in/out, but does not introduce an authentication bypass. ### Specific Go Packages Affected github.com/pomerium/pomerium/authenticate ### Patches Patched in v0.13.4 ### For more information If you have any questions or comments about this advisory * Open an issue in [pomerium](http://github.com/pomerium/pomerium) * Email us at [security@pomerium.com](mailto:security@pomerium.com)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/pomerium/pomerium | >= 0.10.0, < 0.13.4 | 0.13.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pomerium | Pomerium | from 0.10.0 through 0.13.3 |