Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect handling of H2 GOAWAY + SETTINGS frames
Vulnerability Description
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Vulnerability Type
对因果或异常条件的不恰当检查
Vulnerability Title
Caleb Doxsey pomerium 代码问题漏洞
Vulnerability Description
Caleb Doxsey pomerium是Caleb Doxsey开源的一个应用程序。一种身份识别代理，可以安全地访问内部应用程序。 Pomerium 存在代码问题漏洞，该漏洞源于如果在同一个 IO 事件中收到 H/2 GOAWAY 和 SETTINGS 帧，则 Pomerium 所基于的 Envoy 可能会异常终止。
CVSS Information
N/A
Vulnerability Type
N/A