Affected by GO-2022-0783 and 4 other vulnerabilities

GO-2022-0783: JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium

GO-2022-0933: Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium

GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

pomerium

module

v0.0.2 Latest Latest Go to latest Published: Feb 19, 2019 License: Apache-2.0

Details

Pomerium is a tool for managing secure access to internal applications and resources.

Use Pomerium to:

provide a single-sign-on gateway to internal applications.
enforce dynamic access policy based on context, identity, and device state.
aggregate access logs and telemetry data.
an alternative to a VPN.

Check out awesome-zero-trust to learn more about some of the problems Pomerium attempts to address.

To get started with pomerium, check out our quick start guide.

For comprehensive docs, and tutorials see our documentation and the godocs.

Path	Synopsis
authenticate
circuit Package circuit implements the Circuit Breaker pattern.	Package circuit implements the Circuit Breaker pattern.
providers Package providers authentication for third party identity providers (IdP) using OpenID Connect, an identity layer on top of the OAuth 2.0 RFC6749 protocol.	Package providers authentication for third party identity providers (IdP) using OpenID Connect, an identity layer on top of the OAuth 2.0 RFC6749 protocol.
cmd
pomerium
integration
backends/httpdetails Module
backends/ws-echo Module
internal
cryptutil Package cryptutil provides encoding and decoding routines for various cryptographic structures.	Package cryptutil provides encoding and decoding routines for various cryptographic structures.
fileutil
https
httputil
log Package log provides a global logger for zerolog.	Package log provides a global logger for zerolog.
middleware Package middleware provides a standard set of middleware implementations for pomerium.	Package middleware provides a standard set of middleware implementations for pomerium.
options
sessions
templates
version
proto
authenticate
authenticate/mock_authenticate Package mock_authenticate is a generated GoMock package.	Package mock_authenticate is a generated GoMock package.
proxy
authenticator