CVE-2021-39204: Vulnerability in Pomerium based on Envoy
Summary
CVE-2021-39204: Excessive CPU usage in Pomerium. Affects envoy across 4 version ranges.
< 1.16.5
>= 1.17.0, < 1.17.4
>= 1.18.0, < 1.18.4
>= 1.19.0, < 1.19.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-39204 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pomerium is an open source identity-aware access proxy that is built on top of Envoy. Envoy is a high-performance proxy developed in C++ that provides features such as load balancing, routing, and observability for microservices architectures. Pomerium leverages Envoy's capabilities to enable secure access to internal applications. However, a vulnerability has been identified in Envoy's handling of HTTP/2 streams, which affects Pomerium as well.
Vulnerability Detail
The vulnerability arises from Envoy's incorrect handling of resetting HTTP/2 streams with excessive complexity. When a large number of streams are reset, Envoy experiences high CPU utilization, leading to a Denial of Service (DoS) condition. This vulnerability can be exploited to disrupt the availability of Pomerium and potentially impact the accessibility of internal applications protected by Pomerium.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.16.51.16.5 -
>= 1.17.0, < 1.17.41.17.4 -
>= 1.18.0, < 1.18.41.18.4 -
>= 1.19.0, < 1.19.11.19.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. The recommended course of action is to upgrade to the patched versions of Pomerium as mentioned above.
Conclusion
In conclusion, the vulnerability in Pomerium based on Envoy's incorrect handling of HTTP/2 streams can result in a DoS condition. To mitigate this vulnerability, it is crucial to upgrade to the patched versions of Pomerium (0.14.8 or 0.15.1). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for envoy →
FAQ
Pomerium is an open source identity-aware access proxy that provides secure access to internal applications.
Envoy is a high-performance proxy developed in C++ that offers features like load balancing, routing, and observability for microservices architectures.
This vulnerability can lead to a Denial of Service (DoS) condition, potentially disrupting the availability of Pomerium and the accessibility of internal applications protected by it.
To fix this vulnerability, it is recommended to upgrade to versions 0.14.8 or 0.15.1 of Pomerium, which contain a patched envoy binary.
No specific workaround has been provided. Upgrading to the patched versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for envoy.
