CVE-2021-39206

描述

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. This issue can only be triggered when using path prefix based policy. Removing any such policies should provide mitigation.

如何修補 CVE-2021-39206

要修補 CVE-2021-39206,請將受影響套件升級到下列已修補版本。

• —升級至 1.16.5 或更新版本
• —升級至 0.14.8 或更新版本

CVE-2021-39206 正在被利用嗎?

低 — EPSS 為 1.5%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 1.16.5, >= 1.17.0, < 1.17.4, >= 1.18.0, < 1.18.4, >= 1.19.0, < 1.19.1
• >= 0.11.0, < 0.14.8

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-39206
• PATCHgithub.com/pomerium/pomerium
• WEBgithub.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h
• WEBgithub.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9