漏洞描述
在某些FPM设置配置中，低于7.1.33的PHP版本7.1.x，低于7.2.24的7.2.x和低于7.3.11的7.3.x可能会导致FPM模块将过去分配的缓冲区写入保留给FCGI的空间中协议数据，从而打开了远程执行代码的可能性。
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html↗packetstormsecurity.comhttp://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html↗seclists.orghttp://seclists.org/fulldisclosure/2020/Jan/40↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2019:3286↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2019:3287↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2019:3299↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2019:3300↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2019:3724↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2019:3735↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2019:3736↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2020:0322↗bugs.php.nethttps://bugs.php.net/bug.php?id=78599↗github.comhttps://github.com/neex/phuip-fpizdam↗lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...↗lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...↗lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...↗lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr...↗lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr...↗lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr...↗seclists.orghttps://seclists.org/bugtraq/2020/Jan/44↗security.netapp.comhttps://security.netapp.com/advisory/ntap-20191031-0003/↗support.apple.comhttps://support.apple.com/kb/HT210919↗support.f5.comhttps://support.f5.com/csp/article/K75408500?utm_source=f5support&%3Butm_m...↗support.f5.comhttps://support.f5.com/csp/article/K75408500?utm_source=f5support&utm_medium=RSS↗usn.ubuntu.comhttps://usn.ubuntu.com/4166-1/↗usn.ubuntu.comhttps://usn.ubuntu.com/4166-2/↗www.debian.orghttps://www.debian.org/security/2019/dsa-4552↗www.debian.orghttps://www.debian.org/security/2019/dsa-4553↗www.synology.comhttps://www.synology.com/security/advisory/Synology_SA_19_36↗www.tenable.comhttps://www.tenable.com/security/tns-2021-14↗