CVE-2013-2070: debian debian_linux
Vulnerability summary
CVE-2013-2070 is a medium (CVSS 5.8) vulnerability in debian debian_linux. EPSS estimates a 11.92% chance of exploitation in the next 30 days, higher than 96% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 18-07-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
11.92%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 11.92% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian2 products
- nginx< 1.4.1-1 | < 1.2.1-2.2+wheezy1
- debian_linuxEOL6.0 | 7.0
F51 product
- nginx≥ 1.1.4, ≤ 1.2.8 | ≥ 1.3.9, ≤ 1.4.0
Mageia1 product
- nginx< 1.2.9-1.1.mga3
3 vendors · 4 products
References
14 links
- www.openwall.com/lists/oss-security/2013/05/13/3Mailing ListX Refsource MLISTPatchThird Party Advisory
- mailman.nginx.org/pipermail/nginx-announce/2013/000114.htmlMailing ListX Refsource MLISTPatchVendor AdvisoryWEB
- lists.fedoraproject.org/pipermail/package-announce/2013-May/105950.htmlVendor AdvisoryX Refsource FEDORAThird Party AdvisoryWEB