When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

The remote host is affected by the vulnerability described in GLSA-202409-32 (nginx: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its Sever response header, the installed version of nginx is 1.25.x prior to 1.25.4. It may, therefore, affected by the following vulnerabilities:

  - When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause     NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is     considered experimental. (CVE-2024-24989, CVE-2024-24990)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its Server response header, the installed version of nginx is 1.25.x prior to 1.25.4. It is, therefore, affected by the following issues :

 - A NULL pointer dereference in HTTP/3. (CVE-2024-24989)

 - A Use-after-free in HTTP/3. (CVE-2024-24990)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the c97a4ecf-cc25-11ee-b0ee-0050569f0b83 advisory.

  - When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause     NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is     considered experimental. For more information, refer to Support for QUIC and HTTP/3     https://nginx.org/en/docs/quic.html . NOTE: Software versions which have reached End of Technical Support     (EoTS) are not evaluated (CVE-2024-24989)

  - When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause     NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is     considered experimental. For more information, refer to Support for QUIC and HTTP/3     https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support     (EoTS) are not evaluated (CVE-2024-24990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207892	GLSA-202409-32 : nginx: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
190683	nginx 1.25.x < 1.25.4 DoS	Nessus	Web Servers	high
114207	Nginx 1.25.x < 1.25.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
190594	FreeBSD : nginx-devel -- Multiple Vulnerabilities in HTTP/3 (c97a4ecf-cc25-11ee-b0ee-0050569f0b83)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2024-24990

high

Tenable Plugins

medium

high

high

high