GHSA-j34v-3552-5r7j Multiple security issues in Pomerium's embedded envoy
Attackers can cause denial of service or bypass security controls in Pomerium due to vulnerabilities in its embedded Envoy proxy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-j34v-3552-5r7j?
GHSA-j34v-3552-5r7j is a memory corruption vulnerability in github.com/pomerium/pomerium, published on 1 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy, which Pomerium is based on, has issued multiple CVEs impacting stability and security.
Though Pomerium may not be vulnerable to all of the issues, it is recommended that all users upgrade to Pomerium v0.16.4 as soon as possible to minimize risk.
Impact
- Possible DoS or crash
- Resources available to unauthorized users
- Pomerium may trust upstream certificates that should not be trusted
Patches
Patched in v0.16.4
Workarounds
No
References
- CVE-2021-43824 (CVSS Score 6.5, Medium): Envoy 1.21.0 and earlier - Potential null pointer dereference when using JWT filter safe_regex match
- CVE-2021-43825 (CVSS Score 6.1, Medium): Envoy 1.21.0 and earlier - Use-after-free when response filters increase response data, and increased data exceeds downstream buffer limits.
- CVE-2021-43826 (CVSS Score 6.1, Medium): Envoy 1.21.0 and earlier - Use-after-free when tunneling TCP over HTTP, if downstream disconnects during upstream connection establishment
- CVE-2022-21654 (CVSS Score 7.3, High): Envoy 1.7.0 and later - Incorrect configuration handling allows mTLS session re-use without re-validation after validation settings have changed.
- CVE-2022-21655 (CVSS Score 7.5, High): Envoy 1.21 and earlier - Incorrect handling of internal redirects to routes with a direct response entry
- CVE-2022-21657 (CVSS Score 3.1, Low): Envoy 1.20.1 and earlier - X.509 Extended Key Usage and Trust Purposes bypass
For more information
If you have any questions or comments about this advisory:
Open an issue in pomerium/pomerium Email us at [email protected]
Which versions are affected by GHSA-j34v-3552-5r7j?
2 open source packages ship an affected version, including github.com/pomerium/pomerium.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pomerium/pomerium Go | All versions | 0.16.4 |
github.com/pomerium/pomerium Go | All versions | 0.16.4 |
How do I fix GHSA-j34v-3552-5r7j?
Upgrade github.com/pomerium/pomerium to 0.16.4 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-j34v-3552-5r7j being exploited?
There is no known exploitation of GHSA-j34v-3552-5r7j in the wild and no public exploit code.