# Nginx security advisory (CVE-2013-2070)

**URL:** <https://www.ruby-forum.com/t/nginx-security-advisory-cve-2013-2070/228927>\
**Category:** NGINX\
**Created:** [May 13, 2013, 1:34pm UTC](https://www.ruby-forum.com/t/nginx-security-advisory-cve-2013-2070/228927 "2013-05-13T13:34:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\
**Post date:** [May 13, 2013, 1:34pm UTC](https://www.ruby-forum.com/t/nginx-security-advisory-cve-2013-2070/228927/1 "2013-05-13T13:34:17Z")

</div>

Hello!

A security problem related to CVE-2013-2028 was identified,  
affecting some previous nginx versions if proxy\_pass to  
untrusted upstream HTTP servers is used.

The problem may lead to a denial of service or a disclosure of a  
worker process memory on a specially crafted response from an  
upstream proxied server.

The problem affects nginx 1.1.4 - 1.2.8, 1.3.0 - 1.4.0.

The problem is already fixed in nginx 1.5.0, 1.4.1. Version 1.2.9  
was released to address the issue in the 1.2.x legacy branch.

Patch for nginx 1.3.9 - 1.4.0 is the same as for CVE-2013-2028:

[http://nginx.org/download/patch.2013.chunked.txt](http://nginx.org/download/patch.2013.chunked.txt)

Patch for older nginx versions (1.1.4 - 1.2.8, 1.3.0 - 1.3.8)  
can be found here:

[http://nginx.org/download/patch.2013.proxy.txt](http://nginx.org/download/patch.2013.proxy.txt)

–  
Maxim D.  
[http://nginx.org/en/donation.html](http://nginx.org/en/donation.html)