Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01d2pmLTYyaHctcTc4cs0VsQ

Excessive CPU usage

Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset.

Impact

This can result in a DoS condition.

Patches

Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

Workarounds

N/A

References

envoy GSA
envoy CVE
envoy announcement

For more information

If you have any questions or comments about this advisory:

• Open an issue in pomerium/pomerium
• Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-5wjf-62hw-q78r
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01d2pmLTYyaHctcTc4cs0VsQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-5wjf-62hw-q78r, CVE-2021-39204
References:

• https://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78r
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc
• https://nvd.nist.gov/vuln/detail/CVE-2021-39204
• https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ
• https://github.com/advisories/GHSA-5wjf-62hw-q78r

Repository: https://github.com/pomerium/pomerium
Blast Radius: 5.2

Affected Packages