NetSight
IP …
high8.7Known exploitedPublic exploit code

CVE-2019-11043

PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-25. Federal due date: 2022-04-15.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Affected products

VendorProductAffected versions
PhpPhp
from 7.1.0 before 7.1.33
from 7.2.0 before 7.2.24
from 7.3.0 before 7.3.11
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 19.04, 19.10
DebianDebian Linux
Versions 9.0, 10.0
FedoraprojectFedora
Versions 29, 30, 31
TenableTenable.Sc
before 5.19.0
RedhatSoftware Collections
Version 1.0
RedhatEnterprise Linux
Version 8.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Eus
Versions 7.7, 8.1, 8.2, 8.4, 8.6, 8.8
RedhatEnterprise Linux Eus Compute Node
Version 7.7
RedhatEnterprise Linux For Arm 64
Version 8.0_aarch64
RedhatEnterprise Linux For Arm 64 Eus
Versions 8.1_aarch64, 8.2_aarch64, 8.4_aarch64, 8.6_aarch64, 8.8_aarch64

Weakness classification

CWE-120CWE-787

References