CVE-2019-11043

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 99,7%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada php, canonical ubuntu linux +20 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 25 Maret 2022, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Rincian

Terbit di NVD

28 Oktober 2019

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-787: Out-of-bounds Write

EPSS (30 hari)

99,7% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

Masuk KEV

25 Maret 2022

Tenggat CISA

15 April 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 66 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://bugs.php.net/bug.php?id=78599 exploit · issue tracking · patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11043 pemerintah AS
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html mailing list · advisory pihak ketiga
• http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Jan/40 mailing list · advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2019:3286 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2019:3287 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2019:3299 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2019:3300 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2019:3724 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2019:3735 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2019:3736 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2020:0322 advisory pihak ketiga
• https://github.com/neex/phuip-fpizdam exploit · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHH... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OM... mailing list · advisory pihak ketiga
• https://seclists.org/bugtraq/2020/Jan/44 mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20191031-0003/ advisory pihak ketiga
• https://support.apple.com/kb/HT210919 advisory pihak ketiga
• https://support.f5.com/csp/article/K75408500?utm_source=f5support&amp%3Butm_medium=RSS advisory pihak ketiga
• https://usn.ubuntu.com/4166-1/ advisory pihak ketiga
• https://usn.ubuntu.com/4166-2/ advisory pihak ketiga
• https://www.debian.org/security/2019/dsa-4552 mailing list · advisory pihak ketiga