| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/pomerium/pomerium | ≥ 0.14.0, < 0.15.6< 0.15.6 | 0.15.6 |
| pomerium | ≥ 0.14.0, < 0.15.6 | 0.15.6 |
Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowed_idp_claims as part of policy. If using allowed_idp_claims and a user's claims are changed, Pomerium can make incorrect authorization decisions.
v0.15.6
databroker service by clearing redis or restarting the in-memory databroker to force claims to be updatedhttps://github.com/pomerium/pomerium/pull/2724
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free