CVE-2021-39162: 
NixOS vulnerability analysis and mitigation

Pomerium, an open source identity-aware access proxy, contains a vulnerability in its Envoy-based component where receiving an H/2 GOAWAY and SETTINGS frame in the same IO event can cause abnormal termination. The vulnerability was discovered and disclosed on September 9, 2021, and is tracked as CVE-2021-39162. This issue affects Pomerium version 0.15.0 (GHSA).

The vulnerability occurs when Envoy transitions a H/2 connection to the CLOSED state upon receiving a GOAWAY frame without any streams outstanding, and then attempts to transition to DRAINING state when receiving a SETTINGS frame with the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to 0. When these two frames are received in the same I/O event, it results in an invalid state transition from CLOSED to DRAINING, causing abnormal termination of the process (Envoy Advisory).

The vulnerability can lead to a Denial of Service (DoS) condition in the presence of untrusted upstream servers. The severity is rated as High with a CVSS score of 8.6 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) (Envoy Advisory).

The vulnerability has been patched in Pomerium version 0.15.1, which contains an upgraded Envoy binary with this vulnerability fixed. As a workaround, if only trusted upstreams are configured, there is not substantial risk of this condition being triggered (GHSA).