CVE-2019-11043HIGH· 8.7MITRENVDExploit-DB대응게시일: 1970. 01. 01.수정일: 2025. 11. 03.CNA: security@php.netAnalyzed

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause

Memory-Corruption

위협 신호 · CVSS · EPSS · KEV

즉시 패치· 실측 악용 확인 · KEV 등재

CVSS

8.7high

이론적 심각도 점수

EPSS

99.8%상위 0.0%

30일 내 악용 확률 예측

KEV

등재됨

등재일 2022. 03. 25.

패치 기한 2022. 04. 15.

권장 대응 기한3일 이내CISA SSVC 기준

즉시(3일 이내) 패치 — 최우선 대응

KEV 악용자동화 가능외부 노출· KEV 등재 · 자동화 가능 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

악용 경로

공격 벡터네트워크

공격 복잡도높음

필요 권한불필요

사용자 상호작용불필요

범위변경

영향

기밀성 영향높음

무결성 영향높음

가용성 영향없음

버전별 점수

CVSS 3.18.7HIGH· 악용성 2.2· 영향도 5.8

CVSS 3.19.8CRITICAL· 악용성 3.9· 영향도 5.9

CVSS 2.07.5HIGH· 악용성 10· 영향도 6.4

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

약점 (CWE)

CWE-120
고전적 버퍼 오버플로 — 크기 검사 없이 복사해 버퍼를 넘침.
CWE-787
경계 밖 쓰기 — 버퍼 범위를 벗어난 메모리에 써서 충돌·코드 실행으로 이어질 수 있음.

상세 설명

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

영향받는 제품·버전

php php7.1.0 - 7.1.33
other
php php7.2.0 - 7.2.24
other
php php7.3.0 - 7.3.11
other
canonical ubuntu_linux
linux
canonical ubuntu_linux
linux
canonical ubuntu_linux
linux
canonical ubuntu_linux
linux
canonical ubuntu_linux
linux
canonical ubuntu_linux
linux
debian debian_linux
linux
debian debian_linux
linux
fedoraproject fedora
other
fedoraproject fedora
other
fedoraproject fedora
other
tenable tenable.sc< 5.19.0
other
redhat software_collections
linux
redhat enterprise_linux
linux
redhat enterprise_linux_desktop
linux
redhat enterprise_linux_desktop
linux
redhat enterprise_linux_eus
linux
redhat enterprise_linux_eus
linux
redhat enterprise_linux_eus
linux
redhat enterprise_linux_eus
linux
redhat enterprise_linux_eus
linux
redhat enterprise_linux_eus
linux
redhat enterprise_linux_eus_compute_node
linux
redhat enterprise_linux_for_arm_64
linux
redhat enterprise_linux_for_arm_64_eus
linux
redhat enterprise_linux_for_arm_64_eus
linux
redhat enterprise_linux_for_arm_64_eus
linux
redhat enterprise_linux_for_arm_64_eus
linux
redhat enterprise_linux_for_arm_64_eus
linux
redhat enterprise_linux_for_ibm_z_systems
linux
redhat enterprise_linux_for_ibm_z_systems
linux
redhat enterprise_linux_for_ibm_z_systems
linux
redhat enterprise_linux_for_ibm_z_systems_eus
linux
redhat enterprise_linux_for_ibm_z_systems_eus
linux
redhat enterprise_linux_for_ibm_z_systems_eus
linux
redhat enterprise_linux_for_ibm_z_systems_eus
linux
redhat enterprise_linux_for_ibm_z_systems_eus
linux
redhat enterprise_linux_for_ibm_z_systems_eus
linux
redhat enterprise_linux_for_power_big_endian
linux
redhat enterprise_linux_for_power_big_endian
linux
redhat enterprise_linux_for_power_big_endian_eus
linux
redhat enterprise_linux_for_power_little_endian
linux
redhat enterprise_linux_for_power_little_endian
linux
redhat enterprise_linux_for_power_little_endian_eus
linux
redhat enterprise_linux_for_power_little_endian_eus
linux
redhat enterprise_linux_for_power_little_endian_eus
linux
redhat enterprise_linux_for_power_little_endian_eus
linux
redhat enterprise_linux_for_power_little_endian_eus
linux
redhat enterprise_linux_for_power_little_endian_eus
linux
redhat enterprise_linux_for_scientific_computing
linux
redhat enterprise_linux_server
linux
redhat enterprise_linux_server
linux
redhat enterprise_linux_server_aus
linux
redhat enterprise_linux_server_aus
linux
redhat enterprise_linux_server_aus
linux
redhat enterprise_linux_server_aus
linux
redhat enterprise_linux_server_tus
linux
redhat enterprise_linux_server_tus
linux
redhat enterprise_linux_server_tus
linux
redhat enterprise_linux_server_tus
linux
redhat enterprise_linux_server_tus
linux
redhat enterprise_linux_workstation
linux
redhat enterprise_linux_workstation
linux

영향받는 구성 (CPE) 60

php php≥ 7.1.0 < 7.1.33cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
canonical ubuntu_linux 12.04cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
canonical ubuntu_linux 14.04cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
canonical ubuntu_linux 16.04cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
canonical ubuntu_linux 18.04cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
canonical ubuntu_linux 19.04cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
canonical ubuntu_linux 19.10cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
debian debian_linux 9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
debian debian_linux 10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
fedoraproject fedora 29cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
fedoraproject fedora 30cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
fedoraproject fedora 31cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
tenable tenable.sc< 5.19.0cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*
redhat software_collections 1.0cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
redhat enterprise_linux 8.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 7.0cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_eus 7.7cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_eus 8.1cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
redhat enterprise_linux_eus 8.2cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
redhat enterprise_linux_eus 8.4cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
redhat enterprise_linux_eus 8.6cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
redhat enterprise_linux_eus 8.8cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*
redhat enterprise_linux_eus_compute_node 7.7cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64 8.0_aarch64cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64_eus 8.1_aarch64cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.1_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64_eus 8.2_aarch64cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.2_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64_eus 8.4_aarch64cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.4_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64_eus 8.6_aarch64cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64_eus 8.8_aarch64cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems 6.0_s390xcpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems 7.0_s390xcpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems 8.0_s390xcpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems_eus 7.7_s390xcpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.7_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems_eus 8.1_s390xcpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems_eus 8.2_s390xcpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems_eus 8.4_s390xcpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems_eus 8.6_s390xcpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems_eus 8.8_s390xcpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_big_endian 6.0_ppc64cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_big_endian 7.0_ppc64cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_big_endian_eus 7.7_ppc64cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian 7.0_ppc64lecpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian 8.0_ppc64lecpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian_eus 7.7_ppc64lecpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian_eus 8.1_ppc64lecpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian_eus 8.2_ppc64lecpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian_eus 8.4_ppc64lecpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian_eus 8.6_ppc64lecpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian_eus 8.8_ppc64lecpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_scientific_computing 7.0cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 7.0cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.7cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 8.2cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 8.4cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 8.6cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 7.7cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 8.2cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 8.4cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*

참고 자료 28

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html
Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html
Mailing ListThird Party Advisory
http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html
ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Jan/40
Mailing ListThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:3286
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3287
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3299
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3300
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3724
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3735
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3736
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0322
Third Party Advisory
https://bugs.php.net/bug.php?id=78599
ExploitIssue TrackingPatchVendor Advisory
https://github.com/neex/phuip-fpizdam
ExploitThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/
Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/
Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/
Mailing ListThird Party Advisory
https://seclists.org/bugtraq/2020/Jan/44
Mailing ListThird Party Advisory
https://security.netapp.com/advisory/ntap-20191031-0003/
Third Party Advisory
https://support.apple.com/kb/HT210919
Third Party Advisory
https://support.f5.com/csp/article/K75408500?utm_source=f5support&amp%3Butm_medium=RSS
Third Party Advisory
https://usn.ubuntu.com/4166-1/
Third Party Advisory
https://usn.ubuntu.com/4166-2/
Third Party Advisory
https://www.debian.org/security/2019/dsa-4552
Mailing ListThird Party Advisory
https://www.debian.org/security/2019/dsa-4553
Mailing ListThird Party Advisory
https://www.synology.com/security/advisory/Synology_SA_19_36
Third Party Advisory
https://www.tenable.com/security/tns-2021-14
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11043
US Government Resource

링크 내용 불러오는 중…