CVE-2021-39204
published 2021-09-09CVE-2021-39204: Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.61%
72.9th percentile
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | <= 1.16.4 | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.17.0 < 1.17.4 | 1.17.4 |
| envoyproxy | envoy | >= 1.18.0 < 1.18.4 | 1.18.4 |
| github.com | pomerium_pomerium | >= 0 < 0.14.8 | 0.14.8 |
| github.com | pomerium_pomerium | >= 0.15.0 < 0.15.1 | 0.15.1 |
| pomerium | pomerium | < 0.14.8 | 0.14.8 |
| pomerium | pomerium | — | — |
| pomerium | pomerium | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
ghsa7.5HIGH
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Excessive CPU usage
ghsa·2021-09-10·CVSS 7.5
CVE-2021-39204 [HIGH] CWE-834 Excessive CPU usage
Excessive CPU usage
Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset.
### Impact
This can result in a DoS condition.
### Patches
Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.
### Workarounds
N/A
### References
[envoy GSA](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc)
[envoy CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32778)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pomerium/pomerium](https:
OSV
Excessive CPU usage
osv·2021-09-10·CVSS 7.5
CVE-2021-39204 [HIGH] Excessive CPU usage
Excessive CPU usage
Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset.
### Impact
This can result in a DoS condition.
### Patches
Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.
### Workarounds
N/A
### References
[envoy GSA](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc)
[envoy CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32778)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pomerium/pomerium](https:
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcchttps://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78rhttps://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcchttps://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78rhttps://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ
2021-09-09
Published