CVE-2019-11043: Underflow in PHP-FPM can lead to RCE

Critical severity · published Oct 28, 2019

CVE-2019-11043

Underflow in PHP-FPM can lead to RCE

RansomwareIn wildKEV

9.8

CVSS

99.7%

EPSS

Yes

On KEV

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)99.7% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Mar 25, 2022

Federal remediation dueApr 15, 2022

Ransomware campaign useKnown

Affected products

Which versions

PHP · PHP

7.1.x before 7.1.33; 7.2.x before 7.2.24; 7.3.x before 7.3.11 · source: vendor, NVD, KEV

Debian Linux · Debian

9.0; 10.0 · source: NVD

Enterprise Linux · Redhat

8.0 · source: NVD

Enterprise Linux Desktop · Redhat

6.0; 7.0 · source: NVD

Enterprise Linux Eus · Redhat

7.7; 8.1; 8.2; 8.4; 8.6; 8.8 · source: NVD

Enterprise Linux Eus Compute Node · Redhat

7.7 · source: NVD

Enterprise Linux For Arm 64 · Redhat

8.0_aarch64 · source: NVD

Enterprise Linux For Arm 64 Eus · Redhat

8.1_aarch64; 8.2_aarch64; 8.4_aarch64; 8.6_aarch64; 8.8_aarch64 · source: NVD

Enterprise Linux For Ibm Z Systems · Redhat

6.0_s390x; 7.0_s390x; 8.0_s390x · source: NVD

Enterprise Linux For Ibm Z Systems Eus · Redhat

7.7_s390x; 8.1_s390x; 8.2_s390x; 8.4_s390x; 8.6_s390x; 8.8_s390x · source: NVD

Enterprise Linux For Power Big Endian · Redhat

6.0_ppc64; 7.0_ppc64 · source: NVD

Enterprise Linux For Power Big Endian Eus · Redhat

7.7_ppc64 · source: NVD

In the news

VulnerabilityHigh

All-Line Equipment Company Fuel-Boss

View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems. The following versions of All-Line Equipment Company Fuel-Boss are affected: Fuel-Boss V1 Standard >=|<=PHP_7.1.5_7.1.5 (CVE-2018-19518, CVE-2019-11043) Fuel-Boss V1 Portal >=|<=PHP_7.1.5_7.1.5 (CVE-2018-19518, CVE-2019-11043) Fuel-Boss V1 Master/Slave >=|<=PHP_7.1.5_7.1.5 (CVE-2018-19518, CVE-2019-11043) Fuel-Boss V1 Backflush Systems >=|<=PHP_7.1.5_7.1.5 (CVE-2018-19518, CVE-2019-11043) CVSS Vendor Equipment Vulnerabilities v3 8.7 All-Line Equipment Company All-Line Equipment Company Fuel-Boss Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Background Critical Infrastructure Sectors: Critical Manufacturing, Defense Industrial Base, Emergency Services, Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2018-19518 Fuel-Boss is vulnerable to the University of Washington IMAP Toolkit 2007f on UNIX, used in imap_open() in PHP and other products, launching an rsh command via the imap_rimap and tcp_aopen functions without preventing argument injection, which can allow remote attackers to execute arbitrary OS command...

CVE-2018-19518 CVE-2019-11043

Aug 27, 2026·CISA Advisories

Affected product

PHP

All PHP CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-11043

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-11043

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog