PT-2021-23203 · Pomerium · Pomerium

Travisgroth · Published 2021-11-05 · Updated 2022-01-14 · CVE-2021-41230

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pomerium versions prior to 0.15.6

Description Pomerium is an open source identity-aware access proxy. Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowed idp claims as part of policy. If using allowed idp claims and a user's claims are changed, Pomerium can make incorrect authorization decisions.

Recommendations For versions prior to 0.15.6, update to version 0.15.6 to resolve the issue. As a temporary workaround for users unable to upgrade, clear data on the databroker service by clearing redis or restarting the in-memory databroker to force claims to be updated.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-41230

GHSA-J6WP-3859-VXFG

GO-2021-0258

Affected Products

Pomerium

References · 11

• https://github.com/pomerium/pomerium/pull/2724 · Patch
• https://osv.dev/vulnerability/GO-2021-0258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41230 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41230 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j6wp-3859-vxfg · Vendor Advisory
• https://github.com/pomerium/pomerium/security/advisories/GHSA-j6wp-3859-vxfg · Note
• https://github.com/pomerium/pomerium/commit/f20542c4bf2cc691e4c324f7ec79e02e46d95511 · Note
• https://github.com/pomerium/pomerium · Note
• https://pkg.go.dev/vuln/GO-2021-0258 · Note
• https://t.me/cvenotify/23086 · Telegram Post
• https://t.me/cibsecurity/31921 · Telegram Post