一、漏洞信息

漏洞编号：[CVE-2024-24990](https://nvd.nist.gov/vuln/detail/CVE-2024-24990)

漏洞归属组件：[nginx](https://gitee.com/src-openeuler/nginx)

漏洞归属的版本：1.21.5,1.23.2,1.23.3

CVSS V3.0分值：

BaseScore：7.5 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

漏洞简述：

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

漏洞公开时间：2024-02-15 01:15:15

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-24990

<details>

<summary>更多参考(点击展开)</summary>

无

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

其它

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(1.23.3):

2.openEuler-20.03-LTS-SP1(1.21.5):

3.openEuler-20.03-LTS-SP4(1.21.5):

4.openEuler-22.03-LTS(1.21.5):

5.openEuler-22.03-LTS-Next(1.21.5):

6.openEuler-22.03-LTS-SP1(1.21.5):

7.openEuler-22.03-LTS-SP2(1.21.5):

8.openEuler-22.03-LTS-SP3(1.21.5):

修复是否涉及abi变化(是/否)：

1.master(1.23.3):

2.openEuler-20.03-LTS-SP1(1.21.5):

3.openEuler-20.03-LTS-SP4(1.21.5):

4.openEuler-22.03-LTS(1.21.5):

5.openEuler-22.03-LTS-Next(1.21.5):

6.openEuler-22.03-LTS-SP1(1.21.5):

7.openEuler-22.03-LTS-SP2(1.21.5):

8.openEuler-22.03-LTS-SP3(1.21.5):

一、漏洞信息

漏洞编号：[CVE-2024-24990](https://nvd.nist.gov/vuln/detail/CVE-2024-24990)

漏洞归属组件：[nginx](https://gitee.com/src-openeuler/nginx)

CVSS V3.0分值：

BaseScore：7.5 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

漏洞简述：

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

漏洞公开时间：2024-02-15 01:15:15

漏洞创建时间：2024-02-15 03:40:27

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-24990

<details>

<summary>更多参考(点击展开)</summary>

一、漏洞信息

漏洞编号：[CVE-2024-24990](https://nvd.nist.gov/vuln/detail/CVE-2024-24990)

漏洞归属组件：[nginx](https://gitee.com/src-openeuler/nginx)

漏洞归属的版本：1.16.1,1.18.0,1.19.1,1.21.5,1.23.2,1.23.3

CVSS V3.0分值：

BaseScore：7.5 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

漏洞简述：

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

漏洞公开时间：2024-02-15 01:15:15

漏洞创建时间：2024-02-15 03:40:27

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-24990

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| f5sirt.f5.com | https://my.f5.com/manage/s/article/K000138445 | |

一、漏洞信息

漏洞编号：[CVE-2024-24990](https://nvd.nist.gov/vuln/detail/CVE-2024-24990)

漏洞归属组件：[nginx](https://gitee.com/src-openeuler/nginx)

漏洞归属的版本：1.16.1,1.18.0,1.19.1,1.21.5,1.23.2,1.23.3

CVSS V3.0分值：

BaseScore：7.5 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

漏洞简述：

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

漏洞公开时间：2024-02-15 01:15:15

漏洞创建时间：2024-02-15 03:40:27

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-24990

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| f5sirt.f5.com | https://my.f5.com/manage/s/article/K000138445 | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24990 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| suse_bugzilla | https://my.f5.com/manage/s/article/K000138445 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-24990 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| redhat_bugzilla | https://nginx.org/en/docs/quic.html | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

| redhat_bugzilla | https://my.f5.com/manage/s/article/K000138444 | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

| redhat_bugzilla | https://my.f5.com/manage/s/article/K000138445 | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

| redhat_bugzilla | https://nginx.org/en/security_advisories.html | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

其它

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

一、漏洞信息

漏洞编号：[CVE-2024-24990](https://nvd.nist.gov/vuln/detail/CVE-2024-24990)

漏洞归属组件：[nginx](https://gitee.com/src-openeuler/nginx)

漏洞归属的版本：1.16.1,1.18.0,1.19.1,1.21.5,1.23.2,1.23.3

CVSS V3.0分值：

BaseScore：7.5 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

漏洞简述：

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

漏洞公开时间：2024-02-15 01:15:15

漏洞创建时间：2024-02-15 03:40:27

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-24990

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| f5sirt.f5.com | https://my.f5.com/manage/s/article/K000138445 | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24990 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| suse_bugzilla | https://my.f5.com/manage/s/article/K000138445 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-24990 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| redhat_bugzilla | https://nginx.org/en/docs/quic.html | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

| redhat_bugzilla | https://my.f5.com/manage/s/article/K000138444 | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

| redhat_bugzilla | https://my.f5.com/manage/s/article/K000138445 | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

| redhat_bugzilla | https://nginx.org/en/security_advisories.html | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

其它

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

7.5

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：

1.master(1.23.3):

2.openEuler-20.03-LTS-SP1(1.21.5):

3.openEuler-20.03-LTS-SP4(1.21.5):

4.openEuler-22.03-LTS(1.21.5):

5.openEuler-22.03-LTS-Next(1.21.5):

6.openEuler-22.03-LTS-SP1(1.21.5):

7.openEuler-22.03-LTS-SP2(1.21.5):

8.openEuler-22.03-LTS-SP3(1.21.5):

修复是否涉及abi变化(是/否)：

1.master(1.23.3):

2.openEuler-20.03-LTS-SP1(1.21.5):

3.openEuler-20.03-LTS-SP4(1.21.5):

4.openEuler-22.03-LTS(1.21.5):

5.openEuler-22.03-LTS-Next(1.21.5):

6.openEuler-22.03-LTS-SP1(1.21.5):

7.openEuler-22.03-LTS-SP2(1.21.5):

8.openEuler-22.03-LTS-SP3(1.21.5):

一、漏洞信息

漏洞编号：[CVE-2024-24990](https://nvd.nist.gov/vuln/detail/CVE-2024-24990)

漏洞归属组件：[nginx](https://gitee.com/src-openeuler/nginx)

漏洞归属的版本：1.16.1,1.18.0,1.19.1,1.21.5,1.23.2,1.23.3

CVSS V3.0分值：

BaseScore：7.5 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

漏洞简述：

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

漏洞公开时间：2024-02-15 01:15:15

漏洞创建时间：2024-02-15 03:40:27

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-24990

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| f5sirt.f5.com | https://my.f5.com/manage/s/article/K000138445 | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24990 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| suse_bugzilla | https://my.f5.com/manage/s/article/K000138445 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-24990 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 | https://bugzilla.suse.com/show_bug.cgi?id=1219952 |

| redhat_bugzilla | https://nginx.org/en/docs/quic.html | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

| redhat_bugzilla | https://my.f5.com/manage/s/article/K000138444 | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

| redhat_bugzilla | https://my.f5.com/manage/s/article/K000138445 | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

| redhat_bugzilla | https://nginx.org/en/security_advisories.html | https://bugzilla.redhat.com/show_bug.cgi?id=2264298 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

其它

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

7.5

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：

修复是否涉及abi变化(是/否)：