Affected by GO-2022-0783 and 5 other vulnerabilities

GO-2022-0783: JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium

GO-2022-0827: pomerium_signature is not verified in middleware in github.com/pomerium/pomerium

GO-2022-0933: Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium

GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

pkg/

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/pomerium/pomerium

Directories ¶

Path	Synopsis
cryptutil Package cryptutil provides cryptographic utility functions, complementing the lower level abstractions found in the standard library.	Package cryptutil provides cryptographic utility functions, complementing the lower level abstractions found in the standard library.
grpc Package grpc provides gRPC utility functions, complementing the more common ones in the github.com/grpc/grpc-go package	Package grpc provides gRPC utility functions, complementing the more common ones in the github.com/grpc/grpc-go package
audit
config
databroker Package databroker contains databroker protobuf definitions.	Package databroker contains databroker protobuf definitions.
directory Package directory contains protobuf types for directory users.	Package directory contains protobuf types for directory users.
session Package session contains protobuf types for sessions.	Package session contains protobuf types for sessions.
user Package user contains protobuf types for users.	Package user contains protobuf types for users.
grpcutil Package grpcutil contains functions for interacting with gRPC.	Package grpcutil contains functions for interacting with gRPC.
logutil Package logutil contains functionality for working with logs.	Package logutil contains functionality for working with logs.
protoutil Package protoutil contains functions for working with protobuf types.	Package protoutil contains functions for working with protobuf types.
storage Package storage provide generic interface to interact with storage backend.	Package storage provide generic interface to interact with storage backend.
inmemory Package inmemory is the in-memory database using b-trees.	Package inmemory is the in-memory database using b-trees.
redis Package redis is the redis database, implements storage.Backend interface.	Package redis is the redis database, implements storage.Backend interface.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL