When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

According to its Server response header, the installed version of nginx is 1.25.x prior to 1.26.1. It is, therefore, affected by four security issues were identified in nginx HTTP/3 implementation, which might allow an attacker that uses a specially crafted QUIC session to cause a worker process crash (CVE-2024-31079, CVE-2024-32760, CVE-2024-35200), worker process memory disclosure on systems with MTU larger than 4096 bytes (CVE-2024-34161), or might have potential other impact (CVE-2024-31079, CVE-2024-32760).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nginx package has been released.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2e4858330c advisory.

        *) Security: when using HTTP/3, processing of a specially crafted QUIC            session might cause a worker process crash, worker process memory            disclosure on systems with MTU larger than 4096 bytes, or might have            potential other impact (CVE-2024-32760, CVE-2024-31079,            CVE-2024-35200, CVE-2024-34161).
           Thanks to Nils Bars of CISPA.

        *) Bugfix: reduced memory consumption for long-lived requests if gzip,            gunzip, ssi, sub_filter, or grpc_pass directives are used.

        *) Bugfix: nginx could not be built by gcc 14 if the --with-atomic            option was used.
           Thanks to Edgar Bonet.

        *) Bugfix: in HTTP/3.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-06e6dcbb42 advisory.

        *) Security: when using HTTP/3, processing of a specially crafted QUIC            session might cause a worker process crash, worker process memory            disclosure on systems with MTU larger than 4096 bytes, or might have            potential other impact (CVE-2024-32760, CVE-2024-31079,            CVE-2024-35200, CVE-2024-34161).
           Thanks to Nils Bars of CISPA.

        *) Bugfix: reduced memory consumption for long-lived requests if gzip,            gunzip, ssi, sub_filter, or grpc_pass directives are used.

        *) Bugfix: nginx could not be built by gcc 14 if the --with-atomic            option was used.
           Thanks to Edgar Bonet.

        *) Bugfix: in HTTP/3.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 320a19f7-1ddd-11ef-a2ae-8c164567ca3c advisory.

    The nginx development team reports:
    This update fixes the following vulnerabilities:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114423	Nginx 1.25.x < 1.26.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
204459	Photon OS 5.0: Nginx PHSA-2024-5.0-0302	Nessus	PhotonOS Local Security Checks	medium
204168	Photon OS 4.0: Nginx PHSA-2024-4.0-0638	Nessus	PhotonOS Local Security Checks	medium
200239	Fedora 39 : nginx (2024-2e4858330c)	Nessus	Fedora Local Security Checks	medium
200228	Fedora 40 : nginx (2024-06e6dcbb42)	Nessus	Fedora Local Security Checks	medium
198114	FreeBSD : nginx-devel -- Multiple Vulnerabilities in HTTP/3 (320a19f7-1ddd-11ef-a2ae-8c164567ca3c)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2024-35200

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium