PHP · FastCGI Process Manager (FPM)
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
무엇인가
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
CISA: In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 4월 15일
- CISA 목록에 추가됨
- 2022년 3월 25일
- 게시됨
- 2019년 10월 28일
- 심각도
- 높음 8.7 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- 99.7% 알려진 모든 취약점 중 상위 0.1%
- 약점 유형
- CWE-120
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(20)
- https://usn.ubuntu.com/4166-1/
- https://www.debian.org/security/2019/dsa-4552
- https://www.debian.org/security/2019/dsa-4553
- https://usn.ubuntu.com/4166-2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7O…
- https://access.redhat.com/errata/RHSA-2019:3286
- https://access.redhat.com/errata/RHSA-2019:3287
- https://access.redhat.com/errata/RHSA-2019:3299
- https://access.redhat.com/errata/RHSA-2019:3300
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7L…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUH…
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html
- https://access.redhat.com/errata/RHSA-2019:3724
- https://access.redhat.com/errata/RHSA-2019:3735
- https://access.redhat.com/errata/RHSA-2019:3736
- https://github.com/neex/phuip-fpizdam
- https://bugs.php.net/bug.php?id=78599
- https://support.f5.com/csp/article/K75408500?utm_source=f5support&%3Butm_medium=RSS
- https://security.netapp.com/advisory/ntap-20191031-0003/
- https://www.synology.com/security/advisory/Synology_SA_19_36
PHP의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2025. 7. 7. | Command Injection | PHPMailer | 치명적 9.8 | 99.7% |
| 2022. 3. 25. | PHP-CGI Query String Parameter | PHP | 치명적 9.8 | >99.9% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.