CVE-2019-11043

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

This issue only affects instances running php-fpm under nginx server software as environment paths and parameters are handled by different code pieces depending on the server php-fpm is running under. The code where this issue is found is used exclusively when php-fpm detects the request came through an nginx server.

Red Hat Product Security team rated this issue as having a Critical security impact as an attacker may take advantage from the existing bug to cause Remote Code Execution on network exposed software.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

1. Check your nginx configuration files, specially the ones related to php-fpm for presence of pattern bellow on fastcgi_split_path_info regex and PATH_INFO parameter:

     fastcgi_split_path_info     ^(.+?\.php)(/.*)$;
     fastcgi_param    PATH_INFO  $fastcgi_path_info;

2. If fastcgi_split_path_info regex matches with the one above, for each fastcgi_param PATH_INFO entry perform the following change:

     fastcgi_param    PATH_INFO  $fastcgi_path_info if_not_empty;

This step will allow you to safely continue using PATH_INFO parameter while the patch is not applied.

3. Restart your nginx instance:

     systemctl restart nginx