CVE-2021-29652: 
NixOS vulnerability analysis and mitigation

CVE-2021-29652 is a high-severity security vulnerability affecting Pomerium versions 0.10.0 through 0.13.3. The vulnerability was discovered and disclosed on March 31, 2021, impacting certain API endpoints under the /.pomerium/ path that failed to properly verify parameters with pomerium_signature (GitHub Advisory).

The vulnerability stems from a verification bypass in the middleware where some API endpoints under /.pomerium/ do not properly verify parameters with pomerium_signature. This security flaw could potentially allow attackers to modify parameters that were intended to be trusted by Pomerium. The issue primarily affects routes responsible for sign-in/sign-out functionality, though it does not introduce a complete authentication bypass (GitHub Advisory).

The vulnerability could allow malicious actors to modify trusted parameters within Pomerium's system. While the vulnerability affects sign-in/sign-out routes, it's important to note that it does not enable complete authentication bypass scenarios (GitHub Advisory).

The vulnerability has been assigned a High severity rating, indicating significant potential for exploitation. It is classified under CWE-601, suggesting issues related to URL redirection to untrusted sites (GitHub Advisory).

The vulnerability has been patched in Pomerium version 0.13.4. No workarounds are available for affected versions, making upgrading to the patched version the only viable solution (GitHub Advisory).