CVE-2019-11043: Underflow in PHP-FPM can lead to RCE
apachemodphp. Multiple issues were addressed by updating to PHP version 7.3.11.
Other sources
Fixed bug (envpathinfo underflow in fpmmain.c can lead to RCE). (CVE-2019-11043)
— PHP
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
— CISA
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 0:5.3.3-50.el6_10 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 0:5.4.16-46.1.el7_7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 0:5.4.16-46.1.el7_6 - Upgrade
Upgrade
redhat/rh-php70-phpto a version that resolves this vulnerability.Fixed in 0:7.0.27-2.el6 - Upgrade
Upgrade
redhat/rh-php72-phpto a version that resolves this vulnerability.Fixed in 0:7.2.24-1.el7 - Upgrade
Upgrade
redhat/rh-php71-phpto a version that resolves this vulnerability.Fixed in 0:7.1.30-2.el7 - Upgrade
Upgrade
redhat/rh-php70-phpto a version that resolves this vulnerability.Fixed in 0:7.0.27-2.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.3.11 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.24 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.33 - Upgrade
Upgrade
macOS Catalinato a version that resolves this vulnerability.Fixed in 10.15.3 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.1.33 - Configuration
If your fastcgi_split_path_info uses the regex ^(.+?\.php)(/.*)$, change any occurrence of 'fastcgi_param PATH_INFO $fastcgi_path_info;' to 'fastcgi_param PATH_INFO $fastcgi_path_info if_not_empty;' in your nginx php-fpm configuration files.
nginx (php-fpm configuration) fastcgi_param PATH_INFO = $fastcgi_path_info if_not_empty - Operational
Restart nginx to apply the configuration change (example: systemctl restart nginx).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2020-3877
- CVE-2019-11043
- CVE-2020-3857
- CVE-2020-3866
- CVE-2020-3848
- CVE-2020-3849
- CVE-2020-3850
- CVE-2020-3847
- CVE-2020-3835
- CVE-2020-3863
- CVE-2020-9774
- CVE-2020-3827
- CVE-2020-3826
- CVE-2020-3870
- CVE-2020-3878
- CVE-2020-3880
- CVE-2020-3845
- CVE-2020-3837
- CVE-2020-3851
- CVE-2020-3840
- CVE-2020-3875
- CVE-2020-3872
- CVE-2020-3853
- CVE-2020-3836
- CVE-2020-3842
- CVE-2020-3871
- CVE-2020-3846
- CVE-2020-3856
- CVE-2020-3829
- CVE-2020-3830
- CVE-2020-3854
- CVE-2019-18634
- CVE-2020-3855
- CVE-2020-3839
- CVE-2020-3843
- CVE-2020-3838
Frequently Asked Questions
What is CVE-2019-11043?
CVE-2019-11043 is a vulnerability in PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11 that allows remote code execution.
How severe is CVE-2019-11043?
CVE-2019-11043 has a severity rating of 8.1 out of 10, making it critical.
Which software versions are affected by CVE-2019-11043?
PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11 are affected by CVE-2019-11043.
How can I fix CVE-2019-11043?
To fix CVE-2019-11043, you need to update PHP to version 7.1.33, 7.2.24, or 7.3.11.
Where can I find more information about CVE-2019-11043?
You can find more information about CVE-2019-11043 at the following references: [https://www.php.net/ChangeLog-7.php#7.1.33](https://www.php.net/ChangeLog-7.php#7.1.33), [https://support.apple.com/en-us/HT210919](https://support.apple.com/en-us/HT210919), [https://www.cve.org/CVERecord?id=CVE-2019-11043](https://www.cve.org/CVERecord?id=CVE-2019-11043), [https://nvd.nist.gov/vuln/detail/CVE-2019-11043](https://nvd.nist.gov/vuln/detail/CVE-2019-11043), [https://www.nginx.com/blog/php-fpm-cve-2019-11043-vulnerability-nginx/](https://www.nginx.com/blog/php-fpm-cve-2019-11043-vulnerability-nginx/).