Published: 09/09/2021 Updated: 27/09/2021

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 8.6 | Impact Score: 4 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.

Vulnerable Product	Search on Vulmon	Subscribe to Product
envoyproxy envoy
envoyproxy envoy 1.19.0
pomerium pomerium 0.15.0

CWE-754 https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8 https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgv https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-39162

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect