Executive brief
Multiple security issues in Pomerium's embedded envoy
Affected products
- Go github.com/pomerium/pomerium
Junglewise Threat Intelligence
Multiple security issues in Pomerium's embedded envoy
Severity: info ยท Published 2022-03-01
Technologies: github.com/pomerium/pomerium (Go). Vendors: Go.
Related threats
- Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression
- GO-2024-3179 - Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium
- GO-2022-0933 - Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium
- GO-2022-0827 - pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
- GO-2022-0783 - JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium