CVE-2021-29652
First published: Fri Apr 02 2021(Updated: )
### Impact Some API endpoints under /.pomerium/ do not verify parameters with pomerium_signature. This could allow modifying parameters intended to be trusted to Pomerium. The issue mainly affects routes responsible for sign in/out, but does not introduce an authentication bypass. ### Specific Go Packages Affected github.com/pomerium/pomerium/authenticate ### Patches Patched in v0.13.4 ### For more information If you have any questions or comments about this advisory * Open an issue in [pomerium](http://github.com/pomerium/pomerium) * Email us at [security@pomerium.com](mailto:security@pomerium.com)
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/pomerium/pomerium | >=0.10.0<0.13.4 | 0.13.4 |
| Pomerium | >=0.10.0<=0.13.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-29652.
What is the severity level of CVE-2021-29652?
The severity level of CVE-2021-29652 is medium with a CVSS score of 6.1.
Which software versions are affected by CVE-2021-29652?
Software versions between 0.10.0 and 0.13.3 of Pomerium and Pomerium package with version less than 0.13.4 are affected by CVE-2021-29652.
How does CVE-2021-29652 impact Pomerium?
CVE-2021-29652 allows modifying parameters intended to be trusted to Pomerium in certain API endpoints, mainly affecting routes responsible for sign in/out, but does not introduce an authentication bypass.
How can I fix the vulnerability CVE-2021-29652?
Upgrade your Pomerium and Pomerium package to version 0.13.4 or higher to fix the vulnerability CVE-2021-29652.
- collector/github-advisory-latest
- alias/GHSA-fv82-r8qv-ch4v
- alias/CVE-2021-29652
- collector/github-advisory
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/go
- vendor/pomerium
- canonical/pomerium
- version/pomerium/0.10.0
- version/pomerium/0.13.3