CVE-2019-11043

CVE Details

Release Date:	2019-10-28
Impact:	None	What is this?

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

See more information about CVE-2019-11043 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	9.8
Vector String:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Version:	3.0
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 6 (php)	ELSA-2019-3287	2019-10-31
Oracle Linux version 7 (php)	ELSA-2019-3286	2019-10-31
Oracle Linux version 8 (libzip)	ELSA-2019-3735	2019-11-23
Oracle Linux version 8 (libzip)	ELSA-2019-3736	2019-11-23
Oracle Linux version 8 (php)	ELSA-2019-3735	2019-11-23
Oracle Linux version 8 (php)	ELSA-2019-3736	2019-11-23
Oracle Linux version 8 (php-pear)	ELSA-2019-3735	2019-11-23
Oracle Linux version 8 (php-pear)	ELSA-2019-3736	2019-11-23
Oracle Linux version 8 (php-pecl-apcu)	ELSA-2019-3735	2019-11-23
Oracle Linux version 8 (php-pecl-apcu)	ELSA-2019-3736	2019-11-23
Oracle Linux version 8 (php-pecl-zip)	ELSA-2019-3735	2019-11-23
Oracle Linux version 8 (php-pecl-zip)	ELSA-2019-3736	2019-11-23