HIGH🇵🇱 Wersja polska

CVE-2021-39206

CVSS 8.6v3.1pub. 2021-09-09upd. 2024-11-21

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

  • Envoyproxy Envoy

    APP
    Envoyproxy
    1.19.0< 1.16.51.17.0 – 1.17.4 (excl.)1.18.0 – 1.18.4 (excl.)

  • Pomerium

    APP
    Pomerium
    0.15.00.11.0 – 0.14.8 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-33189CRITICAL10.0PL ✓same product

Błąd autoryzacji w Pomerium — obejście kontroli dostępu

CVE-2022-29226CRITICAL10.0PL ✓same product

Envoy OAuth filter: pominięcie walidacji access tokena umożliwia nieautoryzowany dostęp

CVE-2019-18801CRITICAL9.8PL ✓same product

Envoy 1.12.0: zapis poza buforami żądania HTTP/2 prowadzący do RCE lub bypass ACL

CVE-2019-18802CRITICAL9.8PL ✓same product

Bypass mechanizmów kontroli dostępu przez białe znaki w nagłówkach HTTP w Envoy

CVE-2023-44487HIGH7.5⚠ KEVsame product

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can ...