CVE-2022-24797
Medium
Description
Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy, including Pomerium's own proxy service.
SeverityMedium
CVSS6.5
Exploit probability—
ProductPomerium
PublishedMar 31, 2022
First seenMar 31, 2022
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- pomerium pomerium0.17.1 or later
- github.com/pomerium/pomerium0.17.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pomerium pomerium | 0.16.0 ≤ v < 0.17.1 | 0.17.1 |
| github.com/pomerium/pomeriumGo | 0.16.0 ≤ v < 0.17.1 | 0.17.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.