# Tengine-1.4.6 (fixed CVE-2013-2070)

**URL:** <https://www.ruby-forum.com/t/tengine-1-4-6-fixed-cve-2013-2070/228961>\
**Category:** NGINX\
**Created:** [May 14, 2013, 11:40am UTC](https://www.ruby-forum.com/t/tengine-1-4-6-fixed-cve-2013-2070/228961 "2013-05-14T11:40:59Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![yaoweibin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/e9bcb4/32.png) [@yaoweibin](https://www.ruby-forum.com/u/yaoweibin)\
**Post date:** [May 14, 2013, 11:40am UTC](https://www.ruby-forum.com/t/tengine-1-4-6-fixed-cve-2013-2070/228961/1 "2013-05-14T11:40:59Z")

</div>

Hi folks,

Tengine-1.4.6 (development version) has been released.  
You can either checkout the source code from github:  
[GitHub - alibaba/tengine: A distribution of Nginx with some advanced features](https://github.com/alibaba/tengine) or download the tar ball directly:  
[http://tengine.taobao.org/download/tengine-1.4.6.tar.gz](http://tengine.taobao.org/download/tengine-1.4.6.tar.gz)

We have merged the changes from nginx-1.2.9 which fixed the security  
problem CVE-2013-2070. Contents of worker process memory might be  
disclosed if HTTP backend server returned specially crafted response.  
This could cause denial of service or a disclosure of memory.

If you are using Tengine-1.4.x and proxy\_pass to untrusted upstream HTTP  
servers, please upgrade to this version as soon as possible!

Regards,