CVE-2022-24797

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-24797
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24797.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24797
Aliases
Published
2022-03-31T23:15:08Z
Modified
2024-08-21T15:26:51.707178Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
[none]
Details

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to /debug and /metrics paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.

References

Affected packages

Git / github.com/pomerium/pomerium

Affected ranges

Type
GIT
Repo
https://github.com/pomerium/pomerium
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

v0.*

v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.1.0
v0.10.0
v0.10.0-rc1
v0.10.0-rc2
v0.10.0-rc3
v0.11.0
v0.11.0-rc1
v0.11.0-rc2
v0.12.0
v0.14.0
v0.14.0-rc2
v0.15.0
v0.15.6
v0.16.0
v0.17.0
v0.2.0
v0.3.0
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.7.1
v0.7.2
v0.8.0
v0.9.0