DSA-4552: -1 php7.0 -- security update

Published Oct 28, 2019

Updated

Emil Lerner and Andrew Danau discovered that insufficient validation in the path handling code of PHP FPM could result in the execution of arbitrary code in some setups.

Affected Software

2 affected components

debian/php7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade php7.0 to a version that resolves this vulnerability.
Patch DSA-4552-1

Event History

Oct 28, 2019

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2019-11043

Frequently Asked Questions

Which deployments are exposed to arbitrary code execution?

The issue affects PHP FPM setups where the path-handling validation is insufficient. The advisory does not identify the specific web-server or PHP FPM configuration conditions that make a setup vulnerable.

What level of access does an attacker need?

The provided advisory information does not state any authentication or local-access requirement. It only says that arbitrary code execution can result in some affected PHP FPM setups.

How can I determine whether my deployment is affected?

Confirm whether you use the Debian php7.0 package and PHP FPM, then review the linked Debian security tracker entry for CVE-2019-11043 and the DSA-4552 advisory. The supplied information does not provide a configuration test or indicator of compromise.