CVE-2021-39162
published 2021-09-09CVE-2021-39162: Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are…
PriorityP344high8.6CVSS 3.1
AVNACLPRNUINSCCNINAH
EPSS
1.59%
72.5th percentile
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | < 1.18.4 | 1.18.4 |
| envoyproxy | envoy | — | — |
| github.com | pomerium_pomerium | >= 0 < 0.15.1 | 0.15.1 |
| pomerium | pomerium | — | — |
| pomerium | pomerium | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
ghsa7.5HIGH
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium
osv·2024-08-21
CVE-2021-39162 Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium
Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium
Incorrect handling of H2 GOAWAY + SETTINGS frames in github.com/pomerium/pomerium
OSV
Incorrect handling of H2 GOAWAY + SETTINGS frames
osv·2021-09-10·CVSS 7.5
CVE-2021-39162 [HIGH] Incorrect handling of H2 GOAWAY + SETTINGS frames
Incorrect handling of H2 GOAWAY + SETTINGS frames
Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event.
### Impact
This can lead to a DoS in the presence of untrusted *upstream* servers.
### Patches
0.15.1 contains an upgraded envoy binary with this vulnerability patched.
### Workarounds
If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
### References
[envoy GSA](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8)
[envoy CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32780)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)
### For more information
If you have any questio
GHSA
Incorrect handling of H2 GOAWAY + SETTINGS frames
ghsa·2021-09-10·CVSS 7.5
CVE-2021-39162 [HIGH] CWE-754 Incorrect handling of H2 GOAWAY + SETTINGS frames
Incorrect handling of H2 GOAWAY + SETTINGS frames
Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event.
### Impact
This can lead to a DoS in the presence of untrusted *upstream* servers.
### Patches
0.15.1 contains an upgraded envoy binary with this vulnerability patched.
### Workarounds
If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
### References
[envoy GSA](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8)
[envoy CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32780)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)
### For more information
If you have any questio
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgvhttps://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgvhttps://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ
2021-09-09
Published