GHSA-pvrc-wvj2-f59p Pomerium vulnerable to Incorrect Authorization with specially crafted requests

• Go github.com/pomerium/pomerium: >= 0.22.0, < 0.22.2 → fixed in 0.22.2 • Go github.com/pomerium/pomerium: >= 0.21.0, < 0.21.4 → fixed in 0.21.4 • Go github.com/pomerium/pomerium: >= 0.20.0, < 0.20.1 → fixed in 0.20.1 • Go github.com/pomerium/pomerium: >= 0.19.0, < 0.19.2 → fixed in 0.19.2 • Go github.com/pomerium/pomerium: >= 0.18.0, < 0.18.1 → fixed in 0.18.1 • Go github.com/pomerium/pomerium: < 0.17.4 → fixed in 0.17.4

Impact With specially crafted requests, incorrect authorization decisions may be made by Pomerium. Patches We are releasing patch fixes to address this vulnerability going back to `v0.17.X`. Please upgrade to: • v0.22.2 • v0.21.4 • v0.20.1 • v0.19.2 • v0.18.1 • v0.17.4 For more information If you have any questions or comments about this advisory: • Open an issue in pomerium/pomerium • Email us at [email protected]