CVE-2024-35200

Опубликовано: 29 мая 2024

Источник: nvd

CVSS3: 5.3

EPSS Низкий

Описание

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

Ссылки

http://www.openwall.com/lists/oss-security/2024/05/30/4
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/
Third Party Advisory
https://my.f5.com/manage/s/article/K000139612
Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/05/30/4
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/
Third Party Advisory
https://my.f5.com/manage/s/article/K000139612
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*

Версия от 1.25.0 (включая) до 1.26.1 (исключая)

cpe:2.3:a:f5:nginx_plus:r30:-:*:*:*:*:*:*

cpe:2.3:a:f5:nginx_plus:r30:p1:*:*:*:*:*:*

cpe:2.3:a:f5:nginx_plus:r30:p2:*:*:*:*:*:*

cpe:2.3:a:f5:nginx_plus:r31:-:*:*:*:*:*:*

cpe:2.3:a:f5:nginx_plus:r31:p1:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.00666

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-476

Связанные уязвимости

CVE-2024-35200

CVSS3: 5.3

ubuntu

около 1 года назад

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

CVE-2024-35200

CVSS3: 7.5

redhat

около 1 года назад

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

CVE-2024-35200

CVSS3: 5.3

debian

около 1 года назад

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC mod ...

BDU:2024-04389

CVSS3: 7.5

fstec

около 1 года назад

Уязвимость модуля HTTP/3 QUIC (ngx_http_v3_module) веб-серверов NGINX Plus и NGINX OSS, позволяющая нарушителю вызвать отказ в обслуживании

ROS-20240725-01

CVSS3: 7.5

redos

11 месяцев назад

Множественные уязвимости nginx

EPSS

Процентиль: 70%

0.00666

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-476