PT-2021-22419 · Envoy+1 · Envoy+1

Travisgroth · Published 2021-09-09 · Updated 2024-08-21 · CVE-2021-39162

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Pomerium versions prior to 0.15.1

Description Pomerium, an open source identity-aware access proxy based on Envoy, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a Denial of Service (DoS) in the presence of untrusted upstream servers. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.

Recommendations For versions prior to 0.15.1, update to version 0.15.1, which contains an upgraded Envoy binary with this issue patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered, but it is still recommended to update to version 0.15.1 for maximum security.

Fix

DoS

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BIT-ENVOY-2021-39162

CVE-2021-39162

GHSA-GJCG-VRXG-XMGV

GHSA-J374-MJRW-VVP8

GO-2022-0933

Affected Products

Envoy

Pomerium

References · 10

• https://osv.dev/vulnerability/GHSA-gjcg-vrxg-xmgv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39162 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39162 · Security Note
• https://osv.dev/vulnerability/BIT-envoy-2021-39162 · Vendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8 · Note
• https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgv · Note
• https://github.com/pomerium/pomerium · Note
• https://t.me/cibsecurity/28645 · Telegram Post
• https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ · Note