x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2024-39315

[GoVulnBot]

Advisory CVE-2024-39315 references a vulnerability in the following Go modules:

Module
github.com/pomerium/pomerium

Description:
Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at /.pomerium) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be more severe in the presence of a cross-site scripting vulnerability in an upstream application proxied through Pomerium. If an attacker could insert a malicious script onto a web page proxied through Pomerium, that script could access these tokens by making a request to the /.pomerium endpoint. ...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-39315
• FIX: pomerium/pomerium@4c7c432
• WEB: GHSA-rrqr-7w59-637v

Cross references:

• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: GHSA-j34v-3552-5r7j #371 NOT_GO_CODE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2022-24797 #413 EFFECTIVELY_PRIVATE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium/proxy: GHSA-35vc-w93w-75c2 #783 NOT_IMPORTABLE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium/authenticate: GHSA-fv82-r8qv-ch4v #827 NOT_IMPORTABLE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-39204, GHSA-5wjf-62hw-q78r #896 NOT_GO_CODE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-39206, GHSA-cfc2-wjcm-c8fm #897 NOT_GO_CODE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-39162, GHSA-gjcg-vrxg-xmgv #933 NOT_IMPORTABLE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2023-33189 #1800 EFFECTIVELY_PRIVATE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-41230 #258

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/pomerium/pomerium
      vulnerable_at: 0.26.1
summary: CVE-2024-39315 in github.com/pomerium/pomerium
cves:
    - CVE-2024-39315
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-39315
    - fix: https://github.com/pomerium/pomerium/commit/4c7c4320afb2ced70ba19b46de1ac4383f3daa48
    - web: https://github.com/pomerium/pomerium/security/advisories/GHSA-rrqr-7w59-637v
source:
    id: CVE-2024-39315
    created: 2024-07-02T22:01:14.895409014Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/596495 mentions this issue: data/reports: add GO-2024-2965

[gopherbot]

Change https://go.dev/cl/601375 mentions this issue: data/reports: update 3 reports