GitHub Advisoryadvisory · Go

GHSA-5wjf-62hw-q78r Excessive CPU usage

HIGH Published 2021-09-10 Modified 2021-09-10 Official page ↗
Aliases
CVE-2021-39204
Ecosystem
Go
Packages
github.com/pomerium/pomerium
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-834
Reviewed
2021-09-10

Affected packages

• Go github.com/pomerium/pomerium: < 0.14.8 → fixed in 0.14.8 • Go github.com/pomerium/pomerium: >= 0.15.0, < 0.15.1 → fixed in 0.15.1

Description

Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. Impact This can result in a DoS condition. Patches Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched. Workarounds N/A References envoy GSA envoy CVE envoy announcement For more information If you have any questions or comments about this advisory: • Open an issue in pomerium/pomerium • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-39204 Pomerium is an open source identity-aware access proxy. vulnerability

Weakness · CWE (1)

  • CWE-834 Excessive Iteration weakness

References