x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2023-33189

[GoVulnBot]

CVE-2023-33189 references github.com/pomerium/pomerium, which may be a Go module.

Description:
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-33189
• JSON: https://github.com/CVEProject/cvelist/tree/f86b7f7334628a8a5a42becf2552d9a7267412ff/2023/33xxx/CVE-2023-33189.json
• advisory: GHSA-pvrc-wvj2-f59p
• fix: pomerium/pomerium@d315e68
• web: https://github.com/pomerium/pomerium/releases/tag/v0.17.4
• web: https://github.com/pomerium/pomerium/releases/tag/v0.18.1
• web: https://github.com/pomerium/pomerium/releases/tag/v0.19.2
• web: https://github.com/pomerium/pomerium/releases/tag/v0.20.1
• web: https://github.com/pomerium/pomerium/releases/tag/v0.21.4
• web: https://github.com/pomerium/pomerium/releases/tag/v0.22.2
• Imported by: https://pkg.go.dev/github.com/pomerium/pomerium?tab=importedby

Cross references:

• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: GHSA-j34v-3552-5r7j #371 NOT_GO_CODE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2022-24797 #413 EFFECTIVELY_PRIVATE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium/proxy: GHSA-35vc-w93w-75c2 #783 NOT_IMPORTABLE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium/authenticate: GHSA-fv82-r8qv-ch4v #827 NOT_IMPORTABLE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-39204, GHSA-5wjf-62hw-q78r #896 NOT_GO_CODE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-39206, GHSA-cfc2-wjcm-c8fm #897 NOT_GO_CODE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-39162, GHSA-gjcg-vrxg-xmgv #933 NOT_IMPORTABLE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-41230 #258

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/pomerium/pomerium
    packages:
      - package: pomerium
description: |
    Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
cves:
  - CVE-2023-33189
references:
  - advisory: https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p
  - fix: https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb
  - web: https://github.com/pomerium/pomerium/releases/tag/v0.17.4
  - web: https://github.com/pomerium/pomerium/releases/tag/v0.18.1
  - web: https://github.com/pomerium/pomerium/releases/tag/v0.19.2
  - web: https://github.com/pomerium/pomerium/releases/tag/v0.20.1
  - web: https://github.com/pomerium/pomerium/releases/tag/v0.21.4
  - web: https://github.com/pomerium/pomerium/releases/tag/v0.22.2

[gopherbot]

Change https://go.dev/cl/500496 mentions this issue: data/excluded: batch add 9 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606786 mentions this issue: data/reports: unexclude 20 reports (6)