CVE-2021-39206: Incorrect Authorization with specially crafted requests
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pomeriumto a version that resolves this vulnerability.Fixed in v0.14.8 - Upgrade
Upgrade
Pomeriumto a version that resolves this vulnerability.Fixed in v0.15.1 - Configuration
As a mitigation for CVE-2021-32777 and CVE-2021-32779, remove/disable any authorization policies that use path prefix based policy, since the issue can only be triggered with path prefix based policy.
Pomerium path prefix based policy = remove/disable policies that use path prefix based policy
Event History
Frequently Asked Questions
What is CVE-2021-39206?
CVE-2021-39206 is a vulnerability in Pomerium, an open source identity-aware access proxy, that is caused by two authorization vulnerabilities in the underlying Envoy proxy (CVE-2021-32777 and CVE-2021-32779).
How does CVE-2021-39206 affect Envoy?
CVE-2021-39206 affects Envoy versions 1.16.5 up to and including 1.19.0, which are used by Pomerium. It may lead to incorrect routing or authorization policy decisions.
How does CVE-2021-39206 impact Pomerium?
CVE-2021-39206 impacts Pomerium versions 0.11.0 up to and including 0.15.0, as they rely on the affected Envoy versions. It may result in incorrect authorization due to specially crafted requests.
What is the severity of CVE-2021-39206?
CVE-2021-39206 has a severity score of 8.6 (high).
How can I fix CVE-2021-39206 in Pomerium?
To fix CVE-2021-39206 in Pomerium, you should update to a version that includes a patched version of Envoy (higher than 1.19.0) and has fixed the vulnerability.