GHSA-q98f-2x4p-prjr

Suggest an improvement
Source
https://github.com/advisories/GHSA-q98f-2x4p-prjr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-q98f-2x4p-prjr/GHSA-q98f-2x4p-prjr.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-q98f-2x4p-prjr
Aliases
Published
2024-09-06T21:01:22Z
Modified
2024-09-06T21:01:22Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Exposure of debug and metrics endpoints in Pomerium
Details

Impact

In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions.

Patches

v0.17.1

Workarounds

Block access to /debug and /metrics paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.

References

https://github.com/pomerium/pomerium/pull/3212

For more information

If you have any questions or comments about this advisory: * Open an issue in Pomerium * Email us at security@pomerium.com

References

Affected packages

Go / github.com/pomerium/pomerium

Package

Name
github.com/pomerium/pomerium
View open source insights on deps.dev
Purl
pkg:golang/github.com/pomerium/pomerium

Affected ranges

Type
SEMVER
Events
Introduced
0.16.0
Fixed
0.17.1