Lucene search

GoogleOSV:CVE-2024-32760

HistoryMay 29, 2024 - 4:15 p.m.

CVE-2024-32760

2024-05-2916:15:10

Google

osv.dev

nginx

http/3

quic

vulnerability

software

termination

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.5%

JSON

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.

CPENameOperatorVersion
nginxeq1.24.0-2
nginxeq1.26.0-1
nginxeq1.22.1-9
nginxeq1.26.0-1~exp1
nginxeq1.24.0-1
nginxeq1.24.0-1~exp1

Name	Operator	Version
nginx	eq	1.24.0-2
nginx	eq	1.26.0-1
nginx	eq	1.22.1-9
nginx	eq	1.26.0-1~exp1
nginx	eq	1.24.0-1
nginx	eq	1.24.0-1~exp1

References

www.openwall.com/lists/oss-security/2024/05/30/4

lists.fedoraproject.org/archives/list/[email protected]/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/

lists.fedoraproject.org/archives/list/[email protected]/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/

my.f5.com/manage/s/article/K000139609

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.5%

JSON

Related for OSV:CVE-2024-32760