CVE-2023-33189: critical vulnerability in pomerium
Incorrect Authorization with specially crafted requests
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.9%
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected products
pomerium · pomeriumRelated CVEs — pomerium
In the same product, most dangerous first.
CVE-2021-39204HIGHExcessive CPU usage in PomeriumEPSS 1.7%CVE-2021-39162HIGHIncorrect handling of H2 GOAWAY + SETTINGS framesEPSS 1.6%CVE-2021-39206HIGHIncorrect Authorization with specially crafted requestsEPSS 1.5%CVE-2022-24797MEDIUMExposure of Sensitive Information in PomeriumEPSS 1.4%CVE-2021-41230MEDIUMOIDC claims not updated from Identity Provider in PomeriumEPSS 0.9%CVE-2026-50285HIGHPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackEPSS 0.7%
References
https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebbhttps://github.com/pomerium/pomerium/releases/tag/v0.17.4https://github.com/pomerium/pomerium/releases/tag/v0.18.1https://github.com/pomerium/pomerium/releases/tag/v0.19.2https://github.com/pomerium/pomerium/releases/tag/v0.20.1https://github.com/pomerium/pomerium/releases/tag/v0.21.4https://github.com/pomerium/pomerium/releases/tag/v0.22.2https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p