CVE-2021-39162: Incorrect handling of H2 GOAWAY + SETTINGS frames
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted upstream servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pomeriumto a version that resolves this vulnerability.Fixed in 0.15.1 - Compensating control
Ensure only trusted upstreams are configured to reduce the risk of the DoS condition being triggered (untrusted upstream servers can trigger the H2 GOAWAY + SETTINGS handling issue).
Event History
Frequently Asked Questions
What is CVE-2021-39162?
CVE-2021-39162 is a vulnerability in the Pomerium open source identity-aware access proxy, based on the Envoy proxy, that can lead to a denial-of-service (DoS) attack.
How does CVE-2021-39162 impact Envoy?
CVE-2021-39162 can cause an abnormal termination of Envoy if an H/2 GOAWAY and SETTINGS frame are received in the same IO event, leading to a DoS attack.
Is my version of Envoy affected by CVE-2021-39162?
Versions of Envoy up to and excluding 1.18.4 are affected by CVE-2021-39162.
Is my version of Pomerium affected by CVE-2021-39162?
Pomerium version 0.15.0 is affected by CVE-2021-39162.
How can I fix CVE-2021-39162?
To fix CVE-2021-39162, it is recommended to upgrade to a version of Envoy that is not affected or apply the necessary security patches.