PHP · FastCGI Process Manager (FPM)
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
O que é
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
CISA: In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 15 de abril de 2022
- Adicionada à lista da CISA
- 25 de março de 2022
- Publicada
- 28 de outubro de 2019
- Gravidade
- Alto 8,7 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 99,7% entre os 0,1% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-120
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (20)
- https://usn.ubuntu.com/4166-1/
- https://www.debian.org/security/2019/dsa-4552
- https://www.debian.org/security/2019/dsa-4553
- https://usn.ubuntu.com/4166-2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7O…
- https://access.redhat.com/errata/RHSA-2019:3286
- https://access.redhat.com/errata/RHSA-2019:3287
- https://access.redhat.com/errata/RHSA-2019:3299
- https://access.redhat.com/errata/RHSA-2019:3300
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7L…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUH…
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html
- https://access.redhat.com/errata/RHSA-2019:3724
- https://access.redhat.com/errata/RHSA-2019:3735
- https://access.redhat.com/errata/RHSA-2019:3736
- https://github.com/neex/phuip-fpizdam
- https://bugs.php.net/bug.php?id=78599
- https://support.f5.com/csp/article/K75408500?utm_source=f5support&%3Butm_medium=RSS
- https://security.netapp.com/advisory/ntap-20191031-0003/
- https://www.synology.com/security/advisory/Synology_SA_19_36
Mais falhas exploradas de PHP
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 7 de jul. de 2025 | Command Injection | PHPMailer | Crítica 9,8 | 99,7% |
| 25 de mar. de 2022 | PHP-CGI Query String Parameter | PHP | Crítica 9,8 | >99,9% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.