We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2021-39206

Incorrect Authorization with specially crafted requests



AssignerGitHub_M
Reserved2021-08-16
Published2021-09-09
Updated2024-08-04

Description

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.



HIGH: 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Product status

>= 0.11.0, < 0.14.8
affected

>= 0.15.0, < 0.15.1
affected

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9

https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h

https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ

https://github.com/pomerium/pomerium/security/advisories/GHSA-cfc2-wjcm-c8fm

cve.org CVE-2021-39206

nvd.nist.gov CVE-2021-39206

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2021-39206
Subscribe to our newsletter to learn more about our work.