GitHub Advisoryadvisory · Go

GHSA-gjcg-vrxg-xmgv Incorrect handling of H2 GOAWAY + SETTINGS frames

HIGH Published 2021-09-10 Modified 2021-09-10 Official page ↗
Aliases
CVE-2021-39162
Ecosystem
Go
Packages
github.com/pomerium/pomerium
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-754
Reviewed
2021-09-10

Affected packages

• Go github.com/pomerium/pomerium: < 0.15.1 → fixed in 0.15.1

Description

Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. Impact This can lead to a DoS in the presence of untrusted *upstream* servers. Patches 0.15.1 contains an upgraded envoy binary with this vulnerability patched. Workarounds If only trusted upstreams are configured, there is not substantial risk of this condition being triggered. References envoy GSA envoy CVE envoy announcement For more information If you have any questions or comments about this advisory: • Open an issue in pomerium/pomerium • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-39162 Pomerium is an open source identity-aware access proxy. vulnerability

Weakness · CWE (1)

  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References