Bugzilla – Bug 821184
VUL-0: nginx: CVE-2013-2070: Memory disclosure with specially crafted HTTP backend responses
Last modified: 2019-02-06 15:46:04 UTC
Public via nginx.org: http://nginx.org/en/security_advisories.html http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html -------------- A security problem related to CVE-2013-2028 was identified, affecting some previous nginx versions if proxy_pass to untrusted upstream HTTP servers is used. The problem may lead to a denial of service or a disclosure of a worker process memory on a specially crafted response from an upstream proxied server. The problem affects nginx 1.1.4 - 1.2.8, 1.3.0 - 1.4.0. The problem is already fixed in nginx 1.5.0, 1.4.1. Version 1.2.9 was released to address the issue in the 1.2.x legacy branch. Patch for nginx 1.3.9 - 1.4.0 is the same as for CVE-2013-2028: http://nginx.org/download/patch.2013.chunked.txt Patch for older nginx versions (1.1.4 - 1.2.8, 1.3.0 - 1.3.8) can be found here: http://nginx.org/download/patch.2013.proxy.txt -------------- Not vulnerable: 1.5.0+, 1.4.1+, 1.2.9+ Vulnerable: 1.1.4-1.2.8, 1.3.9-1.4.0 Fixes: (for 1.3.9-1.4.0) http://nginx.org/download/patch.2013.chunked.txt http://nginx.org/download/patch.2013.chunked.txt.asc (for 1.1.4-1.2.8) http://nginx.org/download/patch.2013.proxy.txt http://nginx.org/download/patch.2013.proxy.txt.asc
bugbot adjusting priority
update to 1.2.9 at server:http committed (auto-submit to factory) maintenance update from 1.2.6 to 1.2.9 for openSUSE 12.3 submitted: mr#176508
factory has issues with passenger, so that might delay it a bit...
This is an autogenerated message for OBS integration: This bug (821184) was mentioned in https://build.opensuse.org/request/show/176508 Maintenance /
As far I see we have nginx-1.0-1.0.15-0.5.39 on SLES. So it should be not affected. Thanks Marcel for taking care the openSUSE branch !!!
openSUSE-SU-2013:1015-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 821184 CVE References: CVE-2013-2070 Sources used: openSUSE 12.3 (src): nginx-1.2.9-3.4.1
released.
Closing bug.