x/vulndb: potential Go vuln in github.com/pomerium/pomerium: GHSA-pvrc-wvj2-f59p

[GoVulnBot]

In GitHub Security Advisory GHSA-pvrc-wvj2-f59p, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/pomerium/pomerium	0.17.4	< 0.17.4

Cross references:

• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: GHSA-j34v-3552-5r7j #371 NOT_GO_CODE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2022-24797 #413 EFFECTIVELY_PRIVATE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium/proxy: GHSA-35vc-w93w-75c2 #783 NOT_IMPORTABLE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium/authenticate: GHSA-fv82-r8qv-ch4v #827 NOT_IMPORTABLE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-39204, GHSA-5wjf-62hw-q78r #896 NOT_GO_CODE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-39206, GHSA-cfc2-wjcm-c8fm #897 NOT_GO_CODE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-39162, GHSA-gjcg-vrxg-xmgv #933 NOT_IMPORTABLE
• Module github.com/pomerium/pomerium appears in issue x/vulndb: potential Go vuln in github.com/pomerium/pomerium: CVE-2021-41230 #258

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/pomerium/pomerium
    versions:
      - fixed: 0.17.4
    packages:
      - package: github.com/pomerium/pomerium
  - module: github.com/pomerium/pomerium
    versions:
      - introduced: 0.18.0
        fixed: 0.18.1
    packages:
      - package: github.com/pomerium/pomerium
  - module: github.com/pomerium/pomerium
    versions:
      - introduced: 0.19.0
        fixed: 0.19.2
    packages:
      - package: github.com/pomerium/pomerium
  - module: github.com/pomerium/pomerium
    versions:
      - introduced: 0.20.0
        fixed: 0.20.1
    packages:
      - package: github.com/pomerium/pomerium
  - module: github.com/pomerium/pomerium
    versions:
      - introduced: 0.21.0
        fixed: 0.21.4
    packages:
      - package: github.com/pomerium/pomerium
  - module: github.com/pomerium/pomerium
    versions:
      - introduced: 0.22.0
        fixed: 0.22.2
    packages:
      - package: github.com/pomerium/pomerium
summary: Pomerium vulnerable to Incorrect Authorization with specially crafted requests
description: |
    ### Impact

    With specially crafted requests, incorrect authorization decisions may be made by Pomerium.

    ### Patches

    We are releasing patch fixes to address this vulnerability going back to `v0.17.X`. Please upgrade to:

    - v0.22.2
    - v0.21.4
    - v0.20.1
    - v0.19.2
    - v0.18.1
    - v0.17.4


    ### For more information

    If you have any questions or comments about this advisory:

    - Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
    - Email us at [[email protected]](mailto:[email protected])
cves:
  - CVE-2023-33189
ghsas:
  - GHSA-pvrc-wvj2-f59p
references:
  - advisory: https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p
  - fix: https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb
  - advisory: https://github.com/advisories/GHSA-pvrc-wvj2-f59p

[tatianab]

Duplicate of #1800