CVE-2024-32760
Medium
Low
Medium
High
Critical
6.5
CVSS Score
Vulnerability Description
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
N
Scope
U
Confidentiality
N
Integrity
L
Availability
L
Known Affected Software
9 configuration(s) from 2 vendor(s)
nginx_open_source
Version:
1.25.2
CPE:
cpe:2.3:a:f5:nginx_open_source:1.25.2:*:*:*:*:*:*:*
nginx_open_source
Version:
1.25.0
CPE:
cpe:2.3:a:f5:nginx_open_source:1.25.0:*:*:*:*:*:*:*
nginx_open_source
Version:
1.25.4
CPE:
cpe:2.3:a:f5:nginx_open_source:1.25.4:*:*:*:*:*:*:*
nginx_plus
Version:
r30
CPE:
cpe:2.3:a:f5:nginx_plus:r30:p2:*:*:*:*:*:*
nginx_open_source
Version:
1.25.1
CPE:
cpe:2.3:a:f5:nginx_open_source:1.25.1:*:*:*:*:*:*:*
nginx_plus
Version:
r31
CPE:
cpe:2.3:a:f5:nginx_plus:r31:p2:*:*:*:*:*:*
nginx_open_source
Version:
1.25.3
CPE:
cpe:2.3:a:f5:nginx_open_source:1.25.3:*:*:*:*:*:*:*
fedora
Version:
40
CPE:
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
fedora
Version:
39
CPE:
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
This vulnerability affects 9 software configuration(s). Ensure you patch all affected systems.
References & Resources
-
http://www.openwall.com/lists/oss-security/2024/05/30/4f5sirt@f5.com Mailing List
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/f5sirt@f5.com Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/f5sirt@f5.com Third Party Advisory
-
https://my.f5.com/manage/s/article/K000139609f5sirt@f5.com Vendor Advisory
-
http://www.openwall.com/lists/oss-security/2024/05/30/4af854a3a-2127-422b-91ae-364da2661108 Mailing List
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://my.f5.com/manage/s/article/K000139609af854a3a-2127-422b-91ae-364da2661108 Vendor Advisory
Severity Details
6.5
out of 10.0
Medium
Weakness Type (CWE)
CWE-787
Top 25 #2
Out-of-bounds Write
- Description
- The product writes data past the end, or before the beginning, of the intended buffer.
- Exploit Likelihood
- High
- Typical Severity
- High
- Abstraction Level
- Base
Key Information
- Published Date
- May 29, 2024
