CVE Vulnerability

CVE-2021-39206

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

8.6 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h Third Party Advisory
https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ Not Applicable
https://github.com/pomerium/pomerium/security/advisories/GHSA-cfc2-wjcm-c8fm Third Party Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:envoyproxy:envoy:1.19.0:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
cpe:2.3:a:pomerium:pomerium:0.15.0:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
cpe:2.3:a:pomerium:pomerium:*:*:*:*:*:*:*:*
Information

Published : 2021-09-09 11:15

Updated : 2021-09-27 06:30

NVD link : CVE-2021-39206

Mitre link : CVE-2021-39206

Products Affected
No products.
CWE
CWE-863