checked in the patches for nginx 1.5.3; also applied the unix_socket_accept_over_read patch the nginx cores older than 1.5.3.

2024-10-13 00:29:41 +00:00 · 2013-08-30 12:41:13 -07:00
parent c36f990f10
commit 921fd6d675
14 changed files with 2145 additions and 10 deletions
--- a/patches/nginx-1.5.3-cve-2013-2070.patch
+++ b/patches/nginx-1.5.3-cve-2013-2070.patch
@ -0,0 +1,13 @@
+--- src/http/modules/ngx_http_proxy_module.c
+++ src/http/modules/ngx_http_proxy_module.c
+@@ -1865,6 +1865,10 @@ data:
+ 
+     }
+ 
+    if (ctx->size < 0 || ctx->length < 0) {
+        goto invalid;
+    }
+
+     return rc;
+ 
+ done: