CVE-2021-39162GHSA-GJCG-VRXG-XMGVBIT-ENVOY-2021-39162GO-2022-0933
Incorrect handling of H2 GOAWAY + SETTINGS frames
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.15.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted upstream servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
Timeline
- CVE published
- Record last updated
Affected versions
- pomerium pomerium
From 0.15.0 · fixed in 0.15.1
- github.com/pomerium/pomeriumGo
fixed in 0.15.1