{"id":"CVE-2013-2070","aliases":["DEBIAN-CVE-2013-2070","DSA-2721-1","EUVD-2013-2050","GHSA-wwq6-8qmj-449j","MGASA-2013-0160","openSUSE-SU-2024:10044-1"],"status":"published","title":"http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when...","description":"http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.11925,"percentile":0.9614,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2013-06-06T12:24:33Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"nginx","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"nginx","fixed_in":["1.2.1-2.2+wheezy1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"nginx","fixed_in":["1.2.9-1.1.mga3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2.2+wheezy1"}]}],"versions":["1.2.1-2.2"]},{"source":"osv","ecosystem":"Mageia:3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1.1.mga3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-2.5"}]}],"bundled":11}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"f5","product":"nginx"}],"references":[{"url":"http://www.debian.org/security/2013/dsa-2721","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/05/13/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","article","fix"]},{"url":"http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"http://secunia.com/advisories/55181","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=962525","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105950.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/59824","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://nginx.org/download/patch.2013.proxy.txt","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://seclists.org/oss-sec/2013/q2/291","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","article","fix"]},{"url":"http://security.gentoo.org/glsa/glsa-201310-04.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84172","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2070"},{"url":"https://github.com/advisories/GHSA-wwq6-8qmj-449j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2070","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0160.html","tags":["advisory"]},{"url":"http://nginx.org/en/CHANGES-1.2","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4450","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-2070","description":"http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028.","status":"published","published":"2013-07-18T01:00:00Z","modified":"2024-08-06T15:27:39.171Z","updated_at":"2026-11-02T14:34:56.530545Z"}],"euvd":[{"id":"EUVD-2013-2050","description":"http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028.","status":"published","published":"2013-07-18T01:00:00Z","modified":"2024-08-06T15:27:39Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-wwq6-8qmj-449j","title":"http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when...","description":"http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028.","status":"published","published":"2022-05-13T01:05:15Z","modified":"2023-02-01T05:02:48Z","updated_at":"2026-11-02T14:49:58.498747Z"}],"nvd":[{"id":"CVE-2013-2070","description":"http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028.","status":"published","published":"2013-07-20T03:37:25.247Z","modified":"2026-06-16T23:52:41.597Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"CVE-2013-2070","description":"http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028.","status":"published","published":"2013-07-20T03:37:25Z","modified":"2026-04-16T06:21:49.460349379Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2070","description":"http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028.","status":"published","published":"2013-07-20T03:37:25.247Z","modified":"2026-09-01T20:03:15.386319897Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2721-1","title":"nginx - nginx security update","status":"published","published":"2013-07-07T00:00:00Z","modified":"2026-03-09T01:18:52.953026Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0160","title":"Updated nginx package fixes security vulnerability","description":"A security problem related to CVE-2013-2028 was identified, affecting some\nprevious nginx versions if proxy_pass to untrusted upstream HTTP servers is\nused.  The problem may lead to a denial of service or a disclosure of a\nworker process memory on a specially crafted response from an upstream\nproxied server (CVE-2013-2070).\n","status":"published","published":"2013-06-06T12:24:33Z","modified":"2026-04-16T06:26:04.949051564Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10044-1","title":"nginx-1.11.4-2.5 on GA media","description":"These are all security issues fixed in the nginx-1.11.4-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:22:35.012911Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}