8000 Releases · pomerium/pomerium · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Releases: pomerium/pomerium

v0.29.4

22 May 16:13
@calebdoxsey calebdoxsey
v0.29.4 < 8000 /div>
2c9dcfc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.4 Latest
Latest

What's Changed

Changed

Full Changelog: v0.29.3...v0.29.4

Contributors

calebdoxsey and kenjenkins
Assets 10
Loading

v0.29.3

08 May 14:48
@calebdoxsey calebdoxsey
v0.29.3
15dea4f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.3

What's Changed

Changed

  • remove debug log message for directories by @backport-actions-token in #5561
  • circuit breaker: add temporary runtime flag to lift default connection/request limits by @wasaga in #5575
  • add additional authorization check logs by @ba 8000 ckport-actions-token in #5602
  • config: apply unlimited conns setting to internal clusters by @kenjenkins in #5607

Full Changelog: v0.29.2...v0.29.3

Contributors

wasaga and kenjenkins
Loading

v0.29.2

28 Mar 23:11
@calebdoxsey calebdoxsey
v0.29.2
9f591c0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.2

What's Changed

The previous release was mistakenly done against the main branch.

Fixes

Full Changelog: v0.29.0...v0.29.2

Loading

v0.29.1

28 Mar 21:02
@calebdoxsey calebdoxsey
v0.29.1
9f591c0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.1

What's Changed

Fixes

Full Changelog: v0.29.0...v0.29.1

Loading

v0.29.0

26 Mar 17:43
@wasaga wasaga
v0.29.0
ed8c5d6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.0

What's Changed

Breaking

  • Enable seamless request tracing across multiple services with the new OTEL-based tracing system. Users can now easily configure and understand traces, with improved visibility into the flow of requests, even at low sample rates. All previously supported tracing methods are removed. (@kralicky in #5388) and #5447)

New

  • New jwt_issuer_format global setting. (@kenjenkins in #5519)
  • Enable UDP routes with CONNECT-UDP tunneling. (@calebdoxsey in #5390)
  • HTTP/3 Support (@calebdoxsey in #5349)
  • Enable authorization errors to return a JSON response instead of HTML, providing a cleaner and more consistent error format for developers using gRPC services. (@calebdoxsey in #5400 (ENG-1750))
  • Prevent false positive vulnerability reports by only generating a fallback certificate when no other certificate is configured, minimizing unnecessary certificate generation. (@kenjenkins in #5250)
  • Enable precise control over user group claims in JWTs by allowing filtering of groups either globally or per route. This enhancement helps reduce excessive group lists, preventing large headers that can disrupt upstream services while maintaining the integrity of signed JWTs. (@kenjenkins in #5417 (ENG-1802))
  • Enable core Pomerium to access the original PPL policy by adding a source_ppl field to the configuration, ensuring better introspection and compatibility with the Routes Portal. This enhancement allows the raw PPL to be passed alongside the generated Rego, providing more comprehensive policy visibility. (@calebdoxsey in #5419 (ENG-1832))
  • importutil: refactor GenerateRouteNames to allow for protobuf or config routes by @calebdoxsey in #5427
  • Add names, descriptions, and logos to routes, enhancing route cards with clear identifiers and visual appeal. Enjoy a more informative and engaging interface with route-specific icons and descriptions, and easily connect to services with direct links or command instructions. (@calebdoxsey in #5424 (ENG-1833))
  • Enhance Directory Group query performance by introducing a cache warming feature that preloads records, significantly reducing delays and timeouts. (@calebdoxsey in #5439 (ENG-1915))
  • Access your available routes through a new JSON endpoint at /.pomerium/api/v1/routes, providing a list tailored to your permissions. (@calebdoxsey in #5428 (ENG-1845))
  • Discover available routes with a new HTML page that displays each accessible route as a card. This intuitive interface makes navigation and route management simpler and more efficient. (@calebdoxsey in #5443 (ENG-1871))
  • Discover and display site logos automatically by fetching and embedding favicons from destination addresses, enhancing visual recognition and user experience. (@calebdoxsey in #5448)
  • Enhance user experience with new icons for well-known services, making it easier to identify them at a glance. (@calebdoxsey in #5453)
  • Enable dynamic configuration reloading by handling SIGHUP signals, allowing updates without restarting the application. (@calebdoxsey in #5459)
  • Enable customization of the HTTP/3 advertise port in the Alt-Svc header, enhancing flexibility for configurations using protobuf. (@calebdoxsey in #5466)
  • Authenticate using IdP access and identity tokens, with initial support for Azure AD access tokens. (@calebdoxsey in #5484 (ENG-2001, ENG-2001))
  • Improve file management by setting consistent default directories and logging errors when directory environment variables are unset. Ensure file writes are atomic to prevent redundancy and potential file conflicts, enhancing reliability and reducing clutter in temporary storage. (@calebdoxsey in #5477)
  • Enhance performance by reducing redundant session creation for identical IdP tokens. (@calebdoxsey in #5491 (ENG-2025, ENG-2025))
  • Enhance PPL logic with new not and exclude operators, allowing more flexible string and list matching. Define more precise permissions by excluding specific domains or groups in your policy configurations. (@calebdoxsey in #5490 (ENG-2030, ENG-2030))

Fixes

  • Ensure the "groups" claim in JWTs is serialized as an empty list instead of JSON null, improving compatibility with third-party libraries. (@kenjenkins in #5394)
  • Ensure complete and accurate metrics output by properly flushing the buffered writer. (@kenjenkins in #5398)
  • Ensure custom branding settings are consistently applied across all pages, even when using multiple configuration sources. This resolves an issue where core pages were not displaying the correct branding when using an ingress controller, ensuring a uniform appearance with your chosen colors and logo. (@calebdoxsey in #5401 (ENG-1766))
  • Ensure the HTTP redirect server properly uses the proxy protocol when configured. (@calebdoxsey in #5405)
  • Ensure that logo URLs containing % signs are correctly processed, preventing configuration errors in Envoy. This fix allows branding options with special characters to be used without causing issues. (@kenjenkins in #5460 (ENG-1958))
  • Fix the identity_manager_last_session_refresh_errors metrics view. (@kenjenkins in #5543)
  • Reduce memory usage during metrics output by @wasaga in #5530
  • Ensure Pomerium in Zero mode can connect to the cloud control plane using HTTPS_PROXY egress proxy by @wasaga in #5520

Changed

Read more

Contributors

gaurdro, calebdoxsey, and 5 other contributors
Loading

v0.28.0

11 Nov 19:02
@calebdoxsey calebdoxsey
v0.28.0
3e51b4f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.28.0

What's Changed

New

  • More flexible PPL string matchers.
  • Add new jwt issuer format route option.
  • Add an 'issuer' field to the /.well-known/pomerium endpoint.
  • Add new request header variable 'pomerium.jwt'.

Changed

  • Better error serialization for requests from kubectl.
  • Improved header evaluation performance in the authorize service.
  • Improved RouteID calculation performance (used for generating configuration with large numbers of routes).

Bug Fixes

  • Fix enterprise detection in the dashboard.
  • Fix response code redirect option.

Full Changelog: v0.27.2...v0.28.0

Loading

v0.27.2

22 Oct 20:30
@kenjenkins kenjenkins
v0.27.2
788017f
Compare
Choose a tag to compare
v0.27.2

What's Changed

Pomerium Zero

  • Add a Pomerium Zero import tool, allowing you to bring your existing Pomerium configuration into Pomerium Zero.
  • Add active users reporting, for self-serve billing in Pomerium Zero. End user information is pseudonymized and reported to Pomerium Zero, in order to bill paid organizations according to the number of active users across the organization as a whole.

Bug fixes

  • Improve handling of transient errors from the databroker.
  • Fix a data race in the in-memory databroker storage backend.
  • Remove an incorrect “unknown config option” warning message when the set_response_headers config file key is present.

Other changes

  • For any routes where the Kubernetes Service Account Token option is set, allow both websockets and SPDY connection upgrades. (One of these is necessary for commands like kubectl exec and kubectl port-forward to work correctly, depending on your version of Kubernetes.)
  • Previously, the Log Level option could affect the default value of the Authorize Log Fields option: setting the main log level to debug would change the default set of authorize log fields to include headers (logging all HTTP request headers). This undocumented behavior has been removed, and these two options are now entirely independent.
  • Remove some currently-unused configuration options:
    • databroker_storage_cert_file
    • databroker_storage_key_file
    • databroker_storage_ca_file
    • databroker_storage_tls_skip_verify
    • grpc_client_dns_roundrobin
  • Various other minor code clean-up.

Full Changelog: v0.27.1...v0.27.2

Loading

v0.27.1

30 Sep 20:37
@kenjenkins kenjenkins
v0.27.1
a2f98c8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.27.1

Security

Pomerium v0.27.1 includes a fix to the databroker service API authorization logic. Certain service account tokens from Pomerium Zero or Pomerium Enterprise could grant unintended authorization to the databroker service API. CVE-2024-47616

What's Changed

Security

Fixed

Full Changelog: v0.27.0...v0.27.1

Contributors

calebdoxsey and kenjenkins
Loading

v0.27.0

10 Sep 14:02
@wasaga wasaga
v0.27.0
3dadcf1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.27.0

What's Changed

Breaking

New

Fixes

  • authorize: require new login when authenticate url changes by @calebdoxsey in #5165
  • controlplane: avoid calling Close on nil listener by @kenjenkins in #5156
  • databroker/leaser: set timeout on ReleaseLease by @wasaga in #52 8000 08
  • logging: add support for using the standard grpc env vars to control log severity and verbosity by @kralicky in #5120
  • session: do not invalidate based on ID token by @kenjenkins in #5182
  • ui: fix cycle in profile data by @calebdoxsey in #5168
  • ui: set Cache-Control: no-cache, tweak sign-out cancel button behavior by @calebdoxsey in #5264
  • zero/connect: ignore unknown message types by @wasaga in #5223
  • zero/health-checks: fix early checks sometimes missing by @wasaga in #5229
  • zero/health-checks: zero route availability improvements by @wasaga in #5111

Changed

Dependency Updates

Contributors

calebdoxsey, wasaga, and 5 other contributors
Loading

v0.26.1

01 Jul 22:44
@kenjenkins kenjenkins
v0.26.1
eb8dc89
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.26.1

Security

Pomerium v0.26.1 includes multiple security updates:

  • The Pomerium user info page (at /.pomerium) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users, and have now been removed. CVE-2024-39315

    Credit to Vadim Sheydaev, aka Enr1g for reporting this issue.

  • This release also includes an update from Envoy 1.30.1 to Envoy 1.30.3 to address multiple security issues:

    • CVE-2024-34362: Crash (use-after-free) in EnvoyQuicServerStream
    • CVE-2024-34363: Crash due to uncaught nlohmann JSON exception
    • CVE-2024-34364: Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response, and other components
    • CVE-2024-32974: Crash in EnvoyQuicServerStream::OnInitialHeadersComplete()
    • CVE-2024-32975: Crash in QuicheDataReader::PeekVarInt62Length()
    • CVE-2024-32976: Endless loop while decompressing Brotli data with extra input
    • CVE-2024-23326: Envoy incorrectly accepts HTTP 200 response for entering upgrade mode
    • CVE-2024-38525: datadog tracer does not handle trace headers with unicode characters

  • The release also removes a transitive dependency on the gopkg.in/square/go-jose.v2 library which is vulnerable to GHSA-c5q2-7r4c-mv6g.

What's Changed

Security

Fixes

Full Changelog: v0.26.0...v0.26.1

Contributors

calebdoxsey and kenjenkins
Loading
0