Miggo Logo
Miggo Vulnerability Database
→
GHSA-j34v-3552-5r7j

GHSA-j34v-3552-5r7j: Multiple security issues in Pomerium's embedded envoy

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-j34v-3552-5r7j
EPSS Score
-
CWE
-
Published
3/1/2022
Updated
1/11/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/pomerium/pomeriumgo< 0.16.40.16.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The provided vulnerability information describes issues in Envoy (a dependency of Pomerium), but does not include specific code references, commit diffs, or function names within the Pomerium codebase itself. The advisory explicitly states Pomerium 'may not be vulnerable to all of the issues' and recommends upgrading the entire component. Without concrete evidence of vulnerable Pomerium-specific functions or code modifications related to these CVEs, we cannot confidently identify specific functions in github.com/pomerium/pomerium that implement the vulnerable Envoy functionality. The fix appears to involve updating the embedded Envoy dependency rather than modifying Pomerium's own functions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*nvoy, w*i** Pom*rium is **s** on, **s issu** multipl* *V*s imp**tin* st**ility *n* s**urity. T*ou** Pom*rium m*y not ** vuln*r**l* to *ll o* t** issu*s, it is r**omm*n*** t**t *ll us*rs up*r*** to Pom*rium v*.**.* *s soon *s possi*l* to minimiz* ri

Reasoning

T** provi*** vuln*r**ility in*orm*tion **s*ri**s issu*s in *nvoy (* **p*n**n*y o* Pom*rium), *ut *o*s not in*lu** sp**i*i* *o** r***r*n**s, *ommit *i**s, or *un*tion n*m*s wit*in t** Pom*rium *o****s* its*l*. T** **visory *xpli*itly st*t*s Pom*rium '