CVE-2021-39162

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-39162
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8 Third Party Advisory
https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgv Third Party Advisory
https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ Not Applicable Third Party Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8 Third Party Advisory
https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgv Third Party Advisory
https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ Not Applicable Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:1.19.0:*:*:*:*:*:*:*
cpe:2.3:a:pomerium:pomerium:0.15.0:*:*:*:*:*:*:*
History

21 Nov 2024, 06:18

Type Values Removed Values Added
References () https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8 - Third Party Advisory () https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8 - Third Party Advisory
References () https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgv - Third Party Advisory () https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgv - Third Party Advisory
References () https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ - Not Applicable, Third Party Advisory () https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ - Not Applicable, Third Party Advisory

27 Sep 2021, 14:25

Type Values Removed Values Added
CPE cpe:2.3:a:envoyproxy:envoy:1.19.0:*:*:*:*:*:*:*
cpe:2.3:a:pomerium:pomerium:0.15.0:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 8.6 		v2 : 5.0
v3 : 8.6
References (CONFIRM) https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgv - (CONFIRM) https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgv - Third Party Advisory
References (MISC) https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8 - (MISC) https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8 - Third Party Advisory
References (MISC) https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ - (MISC) https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ - Not Applicable, Third Party Advisory

09 Sep 2021, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-09-09 22:15

Updated : 2024-11-21 06:18

NVD link : CVE-2021-39162

Mitre link : CVE-2021-39162

CVE.ORG link : CVE-2021-39162

JSON object : View

Products Affected

envoyproxy

  • envoy

pomerium

  • pomerium
CWE
CWE-754

Improper Check for Unusual or Exceptional Conditions