PT-2013-3527 · Nginx · Nginx

Vincent Danen · Publicado 2013-06-06 · Atualizado 2024-06-15 · CVE-2013-2070

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions nginx versions 1.1.4 through 1.2.8 nginx versions 1.3.0 through 1.4.0

Description The issue allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response when proxy pass is used with untrusted HTTP servers.

Recommendations For nginx versions 1.1.4 through 1.2.8, update to a version outside of this range to resolve the issue. For nginx versions 1.3.0 through 1.4.0, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to untrusted HTTP servers when using proxy pass until a patch is available.

Correção

Identificadores relacionados

CVE-2013-2070

DSA-2721-1

MGASA-2013-0160

OPENSUSE-SU-2024:10044-1

Produtos afetados

Nginx

Referências · 33

• https://suse.com/security/cve/CVE-2014-3556 · Nota
• https://suse.com/security/cve/CVE-2012-2089 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105950.html · Aviso do Fabricante
• https://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html · Nota
• http://openwall.com/lists/oss-security/2013/05/13/3 · Correção
• https://suse.com/security/cve/CVE-2013-2070 · Nota
• http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html · Aviso do Fabricante
• http://nginx.org/download/patch.2013.proxy.txt · Aviso do Fabricante
• http://nginx.org/en/CHANGES-1.2 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10044-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2013-0160 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2070 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-0746 · Nota
• https://suse.com/security/cve/CVE-2011-4315 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=962525 · Correção