GHSA-5wjf-62hw-q78r
Suggest an improvement- Source
- https://github.com/advisories/GHSA-5wjf-62hw-q78r
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-5wjf-62hw-q78r/GHSA-5wjf-62hw-q78r.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-5wjf-62hw-q78r
- Aliases
- Related
- Published
- 2021-09-10T17:54:13Z
- Modified
- 2024-05-19T02:24:44.067289Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Excessive CPU usage
- Details
-
Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset.
Impact
This can result in a DoS condition.
Patches
Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.
Workarounds
N/A
References
envoy GSA envoy CVE envoy announcement
For more information
If you have any questions or comments about this advisory: * Open an issue in pomerium/pomerium * Email us at security@pomerium.com
- Database specific
{ "nvd_published_at": "2021-09-09T22:15:00Z", "severity": "HIGH", "github_reviewed_at": "2021-09-10T16:33:46Z", "github_reviewed": true, "cwe_ids": [ "CWE-834" ] }- References
-
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc
- https://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78r
- https://nvd.nist.gov/vuln/detail/CVE-2021-39204
- https://github.com/pomerium/pomerium
- https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ
Affected packages
Go / github.com/pomerium/pomerium
Package
- Name
- github.com/pomerium/pomerium
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/pomerium/pomerium
Go / github.com/pomerium/pomerium
Package
- Name
- github.com/pomerium/pomerium
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/pomerium/pomerium