QID 150808

Date Published: 2024-02-20

QID 150808: Nginx Multiple HTTP/3 QUIC vulnerabilities (CVE-2024-24989, CVE-2024-24990)

Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module (ngx_http_v3_module), undisclosed requests can cause NGINX worker processes to terminate.

Affected Versions:
NGINX Open source mainline version 1.25.3 or earlier
NGINX Open source subscription packages R5 or R6
NGINX Plus R30 or R31

QID Detection Logic:
This QID checks for the nginx web server by sending a GET request and checking the response header.

This vulnerability allows a remote unauthenticated attacker to cause a denial-of-service (DoS) on the NGINX system.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as High - 7.8 severity.

Solution

Customers are advised toupgrade your NGINX software to the latest version to remediate this vulnerability. For more information related to this vulnerability please refer to Nginx Advisory.

Vendor References

Nginx - www.nginx.com/blog/updating-nginx-for-the-vulnerabilities-in-the-http-3-module/

CVEs related to QID 150808

CVE-2024-24989 | CVE-2024-24990 |

Software Advisories

Advisory ID	Software	Component	Link
Nginx			www.nginx.com/blog/updating-nginx-for-the-vulnerabilities-in-the-http-3-module/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].