According to its self reported version, the installed version of Nginx Plus is R8 (built on Open Source version 1.9.9) prior to R18-P1 (built on Open Source version 1.15.10). It is, therefore, affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in the HTTP/2 protocol stack due to improper handling of exceptional     conditions. An unauthenticated, remote attacker can exploit this, by manipulating the window size and stream     priority of a large data request, to cause a denial of service condition. (CVE-2019-9511)

  - A denial of service vulnerability exists in the HTTP/2 protocol stack due to improper handling of exceptional     conditions. An unauthenticated, remote attacker can exploit this, by creating multiple request streams and     continually shuffling the priority of the streams, to cause a denial of service condition. (CVE-2019-9513)

  - A denial of service vulnerability exists in the HTTP/2 protocol stack due to improper handling of exceptional     conditions. An unauthenticated, remote attacker can exploit this, by sending a stream of headers with a zero length     header name and zero length header value, to cause a denial of service condition. (CVE-2019-9516)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2746 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)

    * HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)

    * HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nginx package has been released.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-4337:01 advisory.

    * HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)
      * HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)
      * HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to Node.js 10.6.13

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the nodejs package has been released.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6754-1 advisory.

    It was discovered that nghttp2 incorrectly handled the HTTP/2 implementation. A remote attacker could     possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue     only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511, CVE-2019-9513)

    It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly     use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only     affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)

    It was discovered that nghttp2 could be made to process an unlimited number of HTTP/2 CONTINUATION frames.
    A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial     of service. (CVE-2024-28182)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
161697	nginx R8 < R18-P1 Multiple Vulnerabilities	Nessus	Web Servers	2022/5/31	2026/7/17	high
194174	RHEL 7 : rh-nginx112-nginx (RHSA-2019:2746)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/6	high
203418	Photon OS 4.0: Nginx PHSA-2023-4.0-0342	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/24	high
289512	MiracleLinux 7 : httpd24-httpd-2.4.34-8.el7.1, httpd24-nghttp2-1.7.1-7.el7.1 (AXSA:2019-4337:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/17	high
128133	Fedora 29 : 1:nodejs (2019-6a2980de56) (0-Length Headers Leak) (Empty Frames Flood) (Internal Data Buffering) (Ping Flood) (Reset Flood) (Resource Loop) (Settings Flood)	Nessus	Fedora Local Security Checks	2019/8/26	2024/5/1	high
203266	Photon OS 4.0: Nodejs PHSA-2022-4.0-0298	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/24	high
193905	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : nghttp2 vulnerabilities (USN-6754-1)	Nessus	Ubuntu Local Security Checks	2024/4/25	2025/9/3	medium

检测

插件搜索

high

high

high

high

high

high

medium