Skip to content
OpenAdvisories
Critical 1 exploited CVE ALAS2-2019-1344 1 CVE

Critical: php security update (Amazon Linux 2)

Published Oct 31, 2019 · Updated Nov 1, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11043: In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. 99999: CVE-2019-11043 php: underflow in env_path_info in fpm_main.c

Fixed packages 25

ReleasePackageFixed in
Amazon Linux · 2 php 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-bcmath 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-cli 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-common 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-dba 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-debuginfo 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-devel 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-embedded 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-enchant 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-fpm 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-gd 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-intl 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-ldap 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-mbstring 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-mysqlnd 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-odbc 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-pdo 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-pgsql 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-process 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-pspell 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-recode 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-snmp 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-soap 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-xml 0:5.4.16-46.amzn2.0.2
Amazon Linux · 2 php-xmlrpc 0:5.4.16-46.amzn2.0.2

Vulnerabilities 1

  • High 8.7
    CVE-2019-11043 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Underflow in PHP-FPM can lead to RCE

    In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibilit…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
    KEV Mar 25, 2022

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-11043.html