cyfenced.com →

[ CVE-2019-11043 · Published 28 Oct 2019 ]

PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 100%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-25
  • Known to be used in ransomware campaigns
  • EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CISA: In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Apr 2022): Apply updates per vendor instructions.

[ References ]References