OIDC claims not updated from Identity Provider in Pomerium
CVE-2021-41230

5.3MEDIUM

Key Information:

Vendor

Pomerium

Status
Pomerium
Vendor
CVE Published:
5 November 2021

What is CVE-2021-41230?

Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowed_idp_claims as part of policy. If using allowed_idp_claims and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on databroker service by clearing redis or restarting the in-memory databroker to force claims to be updated.

Affected Version(s)

pomerium >= 0.14.0, < 0.15.6

References

https://github.com/pomerium/pomerium/security/advisories/...
x_refsource_CONFIRM
https://github.com/pomerium/pomerium/pull/2724
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.