Vulnerability · Published Sep 9, 2021 · Assigned by GitHub_M
CVE-2021-39162Incorrect handling of H2 GOAWAY + SETTINGS frames
High 8.6
In plain English
A high-severity security flaw in pomerium from pomerium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/pomerium/pomerium | 0.15.1 | GHSA-gjcg-vrxg-xmgv |
| Go | github.com/pomerium/pomerium | 0.15.1 | GO-2022-0933 |
Affected products (as reported)
Weakness: CWE-754 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H