CVE-2013-2070

MEDIUM 5.8CVE-2013-2070 · Published 20/07/2013 · updated 16/06/2026

Package	Affected versions	Patched versions
nginx f5	`≥ 1.1.4, ≤ 1.2.8≥ 1.3.9, ≤ 1.4.0`	No fix yet

Description

http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028.

References

lists.fedoraproject.org/pipermail/package-announce/2013-May/105950.html · Third Party Advisory
mailman.nginx.org/pipermail/nginx-announce/2013/000114.html · Patch
nginx.org/download/patch.2013.proxy.txt · Patch
seclists.org/oss-sec/2013/q2/291 · Mailing List
secunia.com/advisories/55181 · Third Party Advisory
security.gentoo.org/glsa/glsa-201310-04.xml · Third Party Advisory
debian.org/security/2013/dsa-2721 · Third Party Advisory
openwall.com/lists/oss-security/2013/05/13/3 · Mailing List
securityfocus.com/bid/59824 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
exchange.xforce.ibmcloud.com/vulnerabilities/84172 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free