PT-2024-38168 · Envoy · Envoy

Published 2024-09-19 · Updated 2024-12-17 · CVE-2024-7207

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Envoy (affected versions not specified)

Description A flaw was found in Envoy, allowing modification or manipulation of headers from external clients when pass-through routes are used for the ingress gateway. This issue could enable a malicious user to forge the requested path logged by Envoy, causing the Envoy proxy to make requests to internal-only services or arbitrary external systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BIT-ENVOY-2024-7207

CVE-2024-7207

Affected Products

Envoy

References · 12

• https://osv.dev/vulnerability/BIT-envoy-2024-7207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7207 · Security Note
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-ffhv-fvxq-r6mf · Note
• https://twitter.com/cracbot/status/1838458419751325925 · Twitter Post
• https://twitter.com/CVEnew/status/1836896400811913391 · Twitter Post
• https://t.me/cvenotify/96018 · Telegram Post
• https://t.me/cvedetector/6082 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1837053584300515662 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2024-7207 · Note
• https://twitter.com/vFeed_IO/status/1868830496719040919 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2300352 · Note
• https://t.me/cvenotify/95376 · Telegram Post