# Security advisory

**URL:** <https://www.ruby-forum.com/t/security-advisory/217888>\
**Category:** NGINX\
**Created:** [March 15, 2012, 1:26pm UTC](https://www.ruby-forum.com/t/security-advisory/217888 "2012-03-15T13:26:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [March 15, 2012, 1:26pm UTC](https://www.ruby-forum.com/t/security-advisory/217888/1 "2012-03-15T13:26:45Z")

</div>

Hello!

Matthew Daley recently discovered a security problem which may  
lead to a disclosure of previously freed memory on specially  
crafted response from an upstream server, potentially resulting in  
sensitive information leak.

Patch for the problem can be found here:

[http://nginx.org/download/patch.2012.memory.txt](http://nginx.org/download/patch.2012.memory.txt)

The patch is not required for 1.1.17, 1.0.14.

Maxim D.

---

<div class="post-metadata">

**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\
**Post date:** [March 15, 2012, 1:52pm UTC](https://www.ruby-forum.com/t/security-advisory/217888/2 "2012-03-15T13:52:51Z")

</div>

> Hello!

Hello Maxim,

> Matthew Daley recently discovered a security problem which may  
> lead to a disclosure of previously freed memory on specially  
> crafted response from an upstream server, potentially resulting in  
> sensitive information leak.
> 
> Patch for the problem can be found here:
> 
> [http://nginx.org/download/patch.2012.memory.txt](http://nginx.org/download/patch.2012.memory.txt)
> 
> The patch is not required for 1.1.17, 1.0.14.

There’s a CVE # for it? Someone asked me about it on twitter.

Thanks,

–appa

---

<div class="post-metadata">

**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\
**Post date:** [March 15, 2012, 2:02pm UTC](https://www.ruby-forum.com/t/security-advisory/217888/3 "2012-03-15T14:02:12Z")

</div>

Hello!

On Thu, Mar 15, 2012 at 01:52:26PM +0100, Antonio P.P. Almeida wrote:

> > [http://nginx.org/download/patch.2012.memory.txt](http://nginx.org/download/patch.2012.memory.txt)
> > 
> > The patch is not required for 1.1.17, 1.0.14.
> 
> There’s a CVE # for it? Someone asked me about it on twitter.

No.

Maxim D.

---

<div class="post-metadata">

**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\
**Post date:** [March 15, 2012, 2:04pm UTC](https://www.ruby-forum.com/t/security-advisory/217888/4 "2012-03-15T14:04:41Z")

</div>

Replying to myself here.

Maxim, Igor, Andrei, Valentin, Ruslan, &c,

I think that there’s room for improvement on the security advisory  
front.

1. Make it official: nginx-sa-01-2012 with an official numbering  
scheme.

2. Get a CVE identifier.

3. Publish it also on security lists like full-disclosure and bugtraq,  
for example

I know that Nginx has been a labour of love of a few people until  
recently.  
But now that you’re an established company I think that having in place  
a  
more formal procedure for security advisories would bring great benefits  
to Nginx as a free software project with its community and as a company  
also.

Just my unsolicited $.02

Salutations distingues,

Antnio

---

<div class="post-metadata">

**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\
**Post date:** [March 15, 2012, 2:47pm UTC](https://www.ruby-forum.com/t/security-advisory/217888/5 "2012-03-15T14:47:01Z")

</div>

Antonio,

On Mar 15, 2012, at 5:04 PM, Antonio P.P. Almeida wrote:

> Just my unsolicited $.02

Thanks, this had been planned and now ongoing.