Affected by GO-2022-0783 and 4 other vulnerabilities

GO-2022-0783: JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium

GO-2022-0933: Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium

GO-2023-1800: Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium

GO-2024-2965: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium

GO-2024-3179: Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

internal/

Details

Path	Synopsis
cryptutil
encoding
ecjson Package ecjson represents encrypted and compressed content using JSON-based	Package ecjson represents encrypted and compressed content using JSON-based
jws Package jws represents content secured with digitalsignatures using JSON-based data structures as specified by rfc7515	Package jws represents content secured with digitalsignatures using JSON-based data structures as specified by rfc7515
mock
fileutil
frontend
statik
grpc
authorize
authorize/client
authorize/client/mock_authorize Package mock_authorize is a generated GoMock package.	Package mock_authorize is a generated GoMock package.
cache
cache/client
httputil
identity Package identity provides support for making OpenID Connect (OIDC) and OAuth2 authenticated HTTP requests with third party identity providers.	Package identity provides support for making OpenID Connect (OIDC) and OAuth2 authenticated HTTP requests with third party identity providers.
kv
autocache
bolt
redis
log Package log provides a global logger for zerolog.	Package log provides a global logger for zerolog.
middleware Package middleware provides a standard set of middleware for pomerium.	Package middleware provides a standard set of middleware for pomerium.
responsewriter
sessions
cache
cookie
header
mock
queryparam
telemetry
metrics
trace
tripper
urlutil
version