Actively exploited · Published Oct 28, 2019 · Assigned by php
CVE-2019-11043Underflow in PHP-FPM can lead to RCE
High 8.7 Exploited Ransomware
In plain English
A high-severity buffer overflow in PHP from PHP. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.7High
Exploit odds (30 days)99.8%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Mar 25, 2022
Attack tooling3Metasploit, Nuclei, Public PoC
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 15, 2022.
Official description
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | apcu-panel | 5.1.17-1.module_el8.3.0+2009+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | apcu-panel | 5.1.12-2.module_el8.3.0+2010+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | libzip | 1.5.1-2.module_el8.4.0+2228+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | libzip | 1.5.1-2.module_el8.5.0+53+9945c2af | ALSA-2019:3735 |
| AlmaLinux:8 | libzip | 1.5.2-1.module_el8.3.0+2009+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | libzip | 1.5.2-1.module_el8.5.0+152+112d3b8c | ALSA-2019:3736 |
| AlmaLinux:8 | libzip | 1.5.1-2.module_el8.3.0+2010+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | libzip | 1.5.2-1.module_el8.4.0+2229+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | libzip-devel | 1.5.1-2.module_el8.4.0+2228+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | libzip-devel | 1.5.2-1.module_el8.5.0+152+112d3b8c | ALSA-2019:3736 |
| AlmaLinux:8 | libzip-devel | 1.5.2-1.module_el8.3.0+2009+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | libzip-devel | 1.5.2-1.module_el8.4.0+2229+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | libzip-devel | 1.5.1-2.module_el8.5.0+53+9945c2af | ALSA-2019:3735 |
| AlmaLinux:8 | libzip-devel | 1.5.1-2.module_el8.3.0+2010+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | libzip-tools | 1.5.1-2.module_el8.4.0+2228+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | libzip-tools | 1.5.1-2.module_el8.5.0+53+9945c2af | ALSA-2019:3735 |
| AlmaLinux:8 | libzip-tools | 1.5.2-1.module_el8.3.0+2009+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | libzip-tools | 1.5.2-1.module_el8.4.0+2229+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | libzip-tools | 1.5.2-1.module_el8.5.0+152+112d3b8c | ALSA-2019:3736 |
| AlmaLinux:8 | libzip-tools | 1.5.1-2.module_el8.3.0+2010+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | php-pear | 1:1.10.9-1.module_el8.3.0+2009+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | php-pear | 1:1.10.5-9.module_el8.3.0+2010+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.17-1.module_el8.4.0+2229+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.12-2.module_el8.3.0+2010+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.12-2.module_el8.4.0+2228+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.12-2.module_el8.5.0+53+9945c2af | ALSA-2019:3735 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.17-1.module_el8.5.0+152+112d3b8c | ALSA-2019:3736 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.17-1.module_el8.3.0+2009+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.17-1.module_el8.3.0+2009+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.17-1.module_el8.4.0+2229+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.17-1.module_el8.5.0+152+112d3b8c | ALSA-2019:3736 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.12-2.module_el8.4.0+2228+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.12-2.module_el8.3.0+2010+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.12-2.module_el8.5.0+53+9945c2af | ALSA-2019:3735 |
| AlmaLinux:8 | php-pecl-zip | 1.15.3-1.module_el8.3.0+2010+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | php-pecl-zip | 1.15.3-1.module_el8.4.0+2228+7c76a223 | ALSA-2019:3735 |
| AlmaLinux:8 | php-pecl-zip | 1.15.3-1.module_el8.5.0+53+9945c2af | ALSA-2019:3735 |
| AlmaLinux:8 | php-pecl-zip | 1.15.4-1.module_el8.4.0+2229+b272fdef | ALSA-2019:3736 |
| AlmaLinux:8 | php-pecl-zip | 1.15.4-1.module_el8.5.0+152+112d3b8c | ALSA-2019:3736 |
| AlmaLinux:8 | php-pecl-zip | 1.15.4-1.module_el8.3.0+2009+b272fdef | ALSA-2019:3736 |
| Rocky Linux:8 | libzip | 0:1.5.1-2.module+el8.4.0+413+c9202dda | RLSA-2019:3735 |
| Rocky Linux:8 | libzip | 0:1.5.2-1.module+el8.4.0+414+2e7afcdd | RLSA-2019:3736 |
| Rocky Linux:8 | php-pear | 1:1.10.9-1.module+el8.4.0+414+2e7afcdd | RLSA-2019:3736 |
| Rocky Linux:8 | php-pear | 1:1.10.5-9.module+el8.4.0+413+c9202dda | RLSA-2019:3735 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.12-2.module+el8.4.0+413+c9202dda | RLSA-2019:3735 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.17-1.module+el8.4.0+414+2e7afcdd | RLSA-2019:3736 |
| Rocky Linux:8 | php-pecl-zip | 0:1.15.3-1.module+el8.4.0+413+c9202dda | RLSA-2019:3735 |
| Rocky Linux:8 | php-pecl-zip | 0:1.15.4-1.module+el8.4.0+414+2e7afcdd | RLSA-2019:3736 |
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
References
- https://github.com/neex/phuip-fpizdam x_refsource_MISC
- https://bugs.php.net/bug.php?id=78599 x_refsource_CONFIRM
- USN-4166-1 vendor-advisory, x_refsource_UBUNTU
- DSA-4552 vendor-advisory, x_refsource_DEBIAN
- DSA-4553 vendor-advisory, x_refsource_DEBIAN
- USN-4166-2 vendor-advisory, x_refsource_UBUNTU
- https://support.f5.com/csp/article/K75408500?utm_source=f5support&%3Butm_medium=RSS x_refsource_CONFIRM
- FEDORA-2019-4adc49a476 vendor-advisory, x_refsource_FEDORA
- https://security.netapp.com/advisory/ntap-20191031-0003/ x_refsource_CONFIRM
- RHSA-2019:3286 vendor-advisory, x_refsource_REDHAT
- RHSA-2019:3287 vendor-advisory, x_refsource_REDHAT
- RHSA-2019:3299 vendor-advisory, x_refsource_REDHAT
- RHSA-2019:3300 vendor-advisory, x_refsource_REDHAT
- FEDORA-2019-187ae3128d vendor-advisory, x_refsource_FEDORA
- FEDORA-2019-7bb07c3b02 vendor-advisory, x_refsource_FEDORA
- openSUSE-SU-2019:2441 vendor-advisory, x_refsource_SUSE
- RHSA-2019:3724 vendor-advisory, x_refsource_REDHAT
- RHSA-2019:3735 vendor-advisory, x_refsource_REDHAT
- RHSA-2019:3736 vendor-advisory, x_refsource_REDHAT
- https://www.synology.com/security/advisory/Synology_SA_19_36 x_refsource_CONFIRM
- openSUSE-SU-2019:2457 vendor-advisory, x_refsource_SUSE
- https://support.apple.com/kb/HT210919 x_refsource_CONFIRM
- 20200129 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra mailing-list, x_refsource_BUGTRAQ
- 20200131 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra mailing-list, x_refsource_FULLDISC
- RHSA-2020:0322 vendor-advisory, x_refsource_REDHAT
- http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html x_refsource_MISC
- https://www.tenable.com/security/tns-2021-14 x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11043 government-resource