MEDIUM🇬🇧 English

CVE-2022-24797

CVSS 6.5v3.1pub. 2022-03-31upd. 2024-11-21

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

  • Pomerium

    APP
    Pomerium
    0.16.0 – 0.17.1 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
DoS
CWE
Referencje

Powiązane podatności

CVE-2023-33189CRITICAL10.0ten sam produkt

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorizati...

CVE-2021-39206HIGH8.6ten sam produkt

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two author...

CVE-2021-39162HIGH8.6ten sam produkt

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally term...

CVE-2021-39204HIGH7.5ten sam produkt

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles...

CVE-2024-39315MEDIUM5.7ten sam produkt

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (...