When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
24 Jan 2025, 16:01
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:f5:nginx_plus:r31:p1:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_plus:r30:p1:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_plus:r31:-:*:*:*:*:*:* cpe:2.3:a:f5:nginx_plus:r30:-:*:*:*:*:*:* cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_plus:r30:p2:*:*:*:*:*:* |
|
| CWE | CWE-787 | |
| References | () http://www.openwall.com/lists/oss-security/2024/05/30/4 - Mailing List | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/ - Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/ - Third Party Advisory | |
| References | () https://my.f5.com/manage/s/article/K000139611 - Vendor Advisory | |
| First Time |
F5
F5 nginx Plus Fedoraproject F5 nginx Open Source Fedoraproject fedora |
Information
Published : 2024-05-29 16:15
Updated : 2025-01-24 16:01
NVD link : CVE-2024-31079
Mitre link : CVE-2024-31079
CVE.ORG link : CVE-2024-31079
JSON object : View
Products Affected
fedoraproject
- fedora
f5
- nginx_plus
- nginx_open_source