Incorrect Authorization with specially crafted requests
Vulnerability Description
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-39206
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h
- https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ
- https://github.com/pomerium/pomerium/security/advisories/GHSA-cfc2-wjcm-c8fm
More from pomerium
View All →Affected Vendor
pomerium
View all reports →