Vulnerability Description
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Envoyproxy | Envoy | < 1.18.4 |
| Pomerium | Pomerium | 0.15.0 |
Related Weaknesses (CWE)
References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8Third Party Advisory
- https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgvThird Party Advisory
- https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJNot ApplicableThird Party Advisory
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8Third Party Advisory
- https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgvThird Party Advisory
- https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJNot ApplicableThird Party Advisory
FAQ
What is CVE-2021-39162?
CVE-2021-39162 is a vulnerability with a CVSS score of 8.6 (HIGH). Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead...
How severe is CVE-2021-39162?
CVE-2021-39162 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-39162?
Check the references section above for vendor advisories and patch information. Affected products include: Envoyproxy Envoy, Pomerium Pomerium.