Pomerium 0.15.4

CPE Details

Pomerium 0.15.4
0.15.4
2021-11-08
18h58 +00:00
2021-11-09
12h50 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:pomerium:pomerium:0.15.4:*:*:*:*:*:*:*

Informations

Vendor

pomerium

Product

pomerium

Version

0.15.4

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2023-33189 2023-05-30 05h39 +00:00 Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
10
Critical
CVE-2021-41230 2021-11-05 21h40 +00:00 Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.
8.8
High