CVE-2021-39206highCWE-863

CVE-2021-39206: fallo de gravedad alta en pomerium

Incorrect Authorization with specially crafted requests

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear pomerium+ Monitorear github.com/pomerium/pomerium

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 1.5%
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Productos afectados
pomerium · pomerium
CVEs relacionadas — pomerium

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-39204HIGHExcessive CPU usage in PomeriumEPSS 1.7%CVE-2021-39162HIGHIncorrect handling of H2 GOAWAY + SETTINGS framesEPSS 1.6%CVE-2022-24797MEDIUMExposure of Sensitive Information in PomeriumEPSS 1.4%CVE-2023-33189CRITICALIncorrect Authorization with specially crafted requestsEPSS 0.9%CVE-2021-41230MEDIUMOIDC claims not updated from Identity Provider in PomeriumEPSS 0.9%CVE-2026-50285HIGHPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackEPSS 0.7%