PHP-FPM Remote Code Execution (CVE-2019-11043)

nginx passing PHP requests to PHP-FPM 7.2.10 with a fastcgi_split_path_info regex that a newline breaks, vulnerable to CVE-2019-11043: an empty PATH_INFO makes PHP-FPM write past a buffer and rewrite its own environment, until PHP settings such as auto_prepend_file are set.

Pas commencé·Docker·commit 6a550e5·x86_64 · aarch64·Secret