PT-2013-3527 · Nginx · Nginx

Vincent Danen · Published 2013-06-06 · Updated 2024-06-15 · CVE-2013-2070

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions nginx versions 1.1.4 through 1.2.8 nginx versions 1.3.0 through 1.4.0

Description The issue allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response when proxy pass is used with untrusted HTTP servers.

Recommendations For nginx versions 1.1.4 through 1.2.8, update to a version outside of this range to resolve the issue. For nginx versions 1.3.0 through 1.4.0, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to untrusted HTTP servers when using proxy pass until a patch is available.

Fix

Related Identifiers

CVE-2013-2070

DSA-2721-1

MGASA-2013-0160

OPENSUSE-SU-2024:10044-1

Affected Products

Nginx

References · 33

• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105950.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/05/13/3 · Patch
• http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html · Vendor Advisory
• http://nginx.org/download/patch.2013.proxy.txt · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10044-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0160 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2070 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=962525 · Patch
• https://cve.org/CVERecord?id=CVE-2013-2070 · Security Note
• https://osv.dev/vulnerability/CVE-2013-2070 · Vendor Advisory
• http://seclists.org/oss-sec/2013/q2/291 · Patch
• http://debian.org/security/2013/dsa-2721 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0160.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-2070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2070 · Security Note