# Updated patch for CVE-2013-2070?

**URL:** <https://www.ruby-forum.com/t/updated-patch-for-cve-2013-2070/235217>\
**Category:** NGINX\
**Created:** [June 7, 2013, 8:38am UTC](https://www.ruby-forum.com/t/updated-patch-for-cve-2013-2070/235217 "2013-06-07T08:38:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alcina](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a587f6/32.png) [@alcina](https://www.ruby-forum.com/u/alcina)\
**Post date:** [June 7, 2013, 8:38am UTC](https://www.ruby-forum.com/t/updated-patch-for-cve-2013-2070/235217/1 "2013-06-07T08:38:26Z")

</div>

Hello.

As stated here  
([http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708164](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708164)), the patch  
nginx developers wrote for fixing CVE-2013-2070 is not 100% correct C.

This is a big issue for us (I’m part of the nginx debian packaging  
team), because this patch can be applied on the Debian Wheezy’s packages  
(1.2.1) but won’t be accepted in the repositories because the patch can  
create new security issues.

Does anyone has an updated version of this patch ?

Thanks.

–  
Cyril “Davromaniak” Lavier  
KeyID 59E9A881  
[http://www.davromaniak.eu](http://www.davromaniak.eu)

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [June 7, 2013, 3:29pm UTC](https://www.ruby-forum.com/t/updated-patch-for-cve-2013-2070/235217/2 "2013-06-07T15:29:43Z")

</div>

Hello!

On Fri, Jun 07, 2013 at 08:37:49AM +0200, Cyril Lavier wrote:

> Hello.
> 
> As stated here  
> ([I Challenge Thee](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708164)), the patch  
> nginx developers wrote for fixing CVE-2013-2070 is not 100% correct C.

From standards point of view - yes, the patch in question might  
not be enough and the check might be, in theory, optimized out by  
a compiler.

It’s not a practical problem though.

> This is a big issue for us (I’m part of the nginx debian packaging  
> team), because this patch can be applied on the Debian Wheezy’s packages  
> (1.2.1) but won’t be accepted in the repositories because the patch can  
> create new security issues.

The patch can’t create new security issues as in worst  
(theoretical) case the check added will be optimized out by a  
compiler.

–  
Maxim D.

> **[nginx: donation](http://nginx.org/en/donation.html)**