CVE-2024-32760

Опубликовано: 29 мая 2024

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.

Ссылки

http://www.openwall.com/lists/oss-security/2024/05/30/4
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/
Third Party Advisory
https://my.f5.com/manage/s/article/K000139609
Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/05/30/4
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/
Third Party Advisory
https://my.f5.com/manage/s/article/K000139609
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*

Версия от 1.25.0 (включая) до 1.26.1 (исключая)

cpe:2.3:a:f5:nginx_plus:r30:-:*:*:*:*:*:*

cpe:2.3:a:f5:nginx_plus:r30:p1:*:*:*:*:*:*

cpe:2.3:a:f5:nginx_plus:r30:p2:*:*:*:*:*:*

cpe:2.3:a:f5:nginx_plus:r31:-:*:*:*:*:*:*

cpe:2.3:a:f5:nginx_plus:r31:p1:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

EPSS

Процентиль: 73%

0.00776

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-787

Связанные уязвимости

CVE-2024-32760

CVSS3: 6.5

ubuntu

около 1 года назад

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.

CVE-2024-32760

CVSS3: 7.5

redhat

около 1 года назад

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.

CVE-2024-32760

CVSS3: 6.5

debian

около 1 года назад

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC mod ...

BDU:2024-04388

CVSS3: 7.5

fstec

около 1 года назад

Уязвимость модуля HTTP/3 QUIC (ngx_http_v3_module) веб-серверов NGINX Plus и NGINX OSS, позволяющая нарушителю вызвать отказ в обслуживании

ROS-20240702-07

CVSS3: 7.5

redos

12 месяцев назад

Уязвимость nginx

EPSS

Процентиль: 73%

0.00776

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-787