CVE-2024-24989
Published: 14 February 2024
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Notes
| Author | Note |
|---|---|
| mdeslaur |
only when built with ngx_http_v3_module introduced in 1.25.0+ |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
nginx
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code not present)
|
| focal |
Not vulnerable
(code not present)
|
|
| jammy |
Not vulnerable
(code not present)
|
|
| mantic |
Not vulnerable
(code not present)
|
|
| noble |
Not vulnerable
(code not present)
|
|
| trusty |
Not vulnerable
(code not present)
|
|
| upstream |
Released
(1.25.4)
|
|
| xenial |
Not vulnerable
(code not present)
|
|
|
Patches:
upstream: https://github.com/nginx/nginx/commit/ed47f72a85fb6279e2ba5d431f64ea4db695cf4e upstream: https://github.com/nginx/nginx/commit/5902baf680609f884a1e11ff2b82a0bffb3724cc upstream: https://github.com/nginx/nginx/commit/5818f8a6693b3c0d95021f2ee58b69dcf848911c |
||