This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] F5 NGINX fixes 4 vulnerabilities
F5 is fixing 4 vulnerabilities in NGINX. The vulnerability was fixed in versions 1.27.0 and 1.26.1 for NGINX Open Source and in versions R32 and R31P2 for NGINX Plus [1][2][3][4].
An unauthenticated remote attacker can gain unauthorized access to certain parts of memory. The vulnerability is exploitable only if NGINX is configured to use the HTTP/3 QUIC module and the network infrastructure supports a maximum packet size of 4096B or more [1].
The vulnerability is present in products:
- NGINX Plus; >=R30, <R31P2;
- NGINX Open Source; >=1.25.0, <1.26.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2024-34161 at cve.org, NVD
- CWE-416 at cwe.mitre.org
The vulnerability was publicly disclosed 29. 5. 2024.
An unauthenticated remote attacker can cause a DoS attack or overwrite data in memory. The vulnerability is exploitable only if NGINX is configured to use the HTTP/3 QUIC module [2].
The vulnerability is present in products:
- NGINX Plus; >=R30, <R31P2;
- NGINX Open Source; >=1.25.0, <1.26.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
More information:
- CVE-2024-32760 at cve.org, NVD
- CWE-787 at cwe.mitre.org
The vulnerability was publicly disclosed 29. 5. 2024.
An unauthenticated remote attacker can carry out a DoS attack. The vulnerability is exploitable only if NGINX is configured to use the HTTP/3 QUIC module [3].
The vulnerability is present in products:
- NGINX Plus; >=R30, <R31P2;
- NGINX Open Source; >=1.25.0, <1.26.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2024-35200 at cve.org, NVD
- CWE-476 at cwe.mitre.org
The vulnerability was publicly disclosed 29. 5. 2024.
An unauthenticated remote attacker can carry out a DoS attack. The vulnerability is exploitable only if NGINX is configured to use the HTTP/3 QUIC module. Exploitation also depends on the correct timing of the requests sent [4].
The vulnerability is present in products:
- NGINX Plus; >=R30, <R31P2;
- NGINX Open Source; >=1.25.0, <1.26.1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
More information:
- CVE-2024-31079 at cve.org, NVD
- CWE-121 at cwe.mitre.org
The vulnerability was publicly disclosed 29. 5. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 30. 5. 2024.