CVE-2013-0337
Published: 27 October 2013
The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.
Notes
| Author | Note |
|---|---|
| mdeslaur | The fix for CVE-2016-1247 in USN-3114-1 technically re-introduced this issue, but only for environments that configure non-default log filenames. Upstream will not be fixing the default permissions on log files. Marking this CVE as ignored, since the default configuration is not vulnerable and we will not be fixing this any further. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
nginx Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
| bionic |
Ignored
|
|
| hardy |
Ignored
(end of life)
|
|
| lucid |
Ignored
(end of life)
|
|
| oneiric |
Ignored
(end of life)
|
|
| precise |
Ignored
(end of life)
|
|
| quantal |
Ignored
(end of life)
|
|
| raring |
Ignored
(end of life)
|
|
| saucy |
Ignored
(end of life)
|
|
| trusty |
Ignored
|
|
| upstream |
Released
(1.6.2-5, 1.4.4-2)
|
|
| utopic |
Not vulnerable
(1.4.4-4ubuntu1)
|
|
| vivid |
Not vulnerable
(1.4.4-4ubuntu1)
|
|
| wily |
Not vulnerable
(1.4.4-4ubuntu1)
|
|
| xenial |
Ignored
|
|
| yakkety |
Ignored
(end of life)
|
|
| zesty |
Ignored
(end of life)
|