# Urgent security issue in NGINX/php-fpm **URL:** \ **Category:** 📰 News\ **Created:** [October 24, 2019, 2:05pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665 "2019-10-24T14:05:56Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![system](https://help.nextcloud.com/user_avatar/help.nextcloud.com/system/32/29333_2.png) [@system](https://help.nextcloud.com/u/system)\ **Post date:** [October 24, 2019, 2:05pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/1 "2019-10-24T14:05:56Z")
Originally published at: [https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/](https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/) Dear system administrators, In the last 24 hours, a new security risk has emerged around NGINX, documented in CVE-2019-11043. This exploit allows for remote code execution on some NGINX and php-fpm configurations. If you do not run NGINX, this exploit does not effect you. Unfortunately the default Nextcloud NGINX configuration is also vulnerable to this attack. We recommend all system administrators take immediate actions: 1. Upgrade your php packages to the latest version. A new release that fixes the issue is to be released on the 24th of October. See [https://www.php.net/archive/2019.php#2019-10-24-1](https://www.php.net/archive/2019.php#2019-10-24-1) Upstream php packages with the fix are: 2. Update your nginx config file. We have updated the configuration in our documentation. Since there are only two changes in the nginx configuration we highlight them here: ``` location / { rewrite ^ /index.php$request_uri; } ``` Should become ``` location / { rewrite ^ /index.php; } ``` Note the removal of **`$request_uri`** And ``` location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) { fastcgi_split_path_info ^(.+?\.php)(\/.*|)$; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $path_info; fastcgi_param HTTPS on; # Avoid sending the security headers twice fastcgi_param modHeadersAvailable true; # Enable pretty urls fastcgi_param front_controller_active true; fastcgi_pass php-handler; fastcgi_intercept_errors on; fastcgi_request_buffering off; } ``` Should become: ``` location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) { fastcgi_split_path_info ^(.+?\.php)(\/.*|)$; try_files $fastcgi_script_name =404; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $path_info; fastcgi_param HTTPS on; # Avoid sending the security headers twice fastcgi_param modHeadersAvailable true; # Enable pretty urls fastcgi_param front_controller_active true; fastcgi_pass php-handler; fastcgi_intercept_errors on; fastcgi_request_buffering off; } ``` Note the addition of the **`$try_files $fastcgi_script_name =404;`** Then restart your webserver and the issue is mitigated. See our [full documentation here](https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html). If you are running the docker containers from [https://hub.docker.com/\_/nextcloud](https://hub.docker.com/_/nextcloud) those will also receive updates with new php-fpm versions when available. If you are a Nextcloud customer, you should already have been notified of this issue. If you need any assistance, contact our support team through [our portal.](https://portal.nextcloud.com) ---
**Author:** ![Nemskiller](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nemskiller/32/875_2.png) [@Nemskiller](https://help.nextcloud.com/u/Nemskiller)\ **Post date:** [October 24, 2019, 2:08pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/2 "2019-10-24T14:08:30Z")
My Ubuntu 18.04 doesn’t propose me PHP 7.3.11. I am on 7.3.10, how can i force the repo to update ? ---
**Author:** ![Schmu](https://help.nextcloud.com/user_avatar/help.nextcloud.com/schmu/32/7823_2.png) [@Schmu](https://help.nextcloud.com/u/Schmu)\ **Post date:** [October 24, 2019, 3:18pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/3 "2019-10-24T15:18:46Z")
Hi @Nemskiller You can follow the steps from this answer: [https://askubuntu.com/questions/1111922/upgrade-to-the-latest-php-version-in-ubuntu-16-04](https://askubuntu.com/questions/1111922/upgrade-to-the-latest-php-version-in-ubuntu-16-04) Just replace every 7.2 with 7.3 in his answer. He stated that as an update in his answer as well: > **Update:** > > Yesterday, I’ve used the above set of commands to install PHP 7.3 on Ubuntu 16.04 and everything went completely fine. Just replace _7.2_ with _7.3_ within these commands - the entire process took about 7 minutes. ---
**Author:** ![fwolfst](https://help.nextcloud.com/user_avatar/help.nextcloud.com/fwolfst/32/9508_2.png) [@fwolfst](https://help.nextcloud.com/u/fwolfst)\ **Post date:** [October 24, 2019, 3:39pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/4 "2019-10-24T15:39:37Z")
7.3.11 packages are not yet released on [https://launchpad.net/%7Eondrej/+archive/ubuntu/php/+index?batch=75&memo=150&start=150](https://launchpad.net/%7Eondrej/+archive/ubuntu/php/+index?batch=75&memo=150&start=150) . I am sure it will come soon. ---
**Author:** ![Schmu](https://help.nextcloud.com/user_avatar/help.nextcloud.com/schmu/32/7823_2.png) [@Schmu](https://help.nextcloud.com/u/Schmu)\ **Post date:** [October 24, 2019, 3:48pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/5 "2019-10-24T15:48:48Z")
@system And the workaround is sufficient and reliable? The last comment from the bug report reads: > A method to quick fix this problem. > If you want to use PATH\_INFO in php, and do not want to patch and recompile PHP. > > Add this line before ALL YOUR “location ~ .php(/|$) {” LINES in nginx confs: ```auto rewrite ^(.*?)\n $1; #Fix CVE-2019-11043 (THIS LINE!!!) location ~ \.php(/|$) { ... fastcgi_split_path_info ^((?U).+\.php)(/?.+)$; ... ``` > That will truncate PATH\_INFO after “\n” while URL contains “%0a”. ([PHP :: Sec Bug #78599 :: env\_path\_info underflow in fpm\_main.c can lead to RCE](https://bugs.php.net/bug.php?id=78599)) Is this something which should be added as well? ---
**Author:** ![jknockaert](https://help.nextcloud.com/letter_avatar/jknockaert/32/6_22734026db12803ebb3e059622ac3534.png) [@jknockaert](https://help.nextcloud.com/u/jknockaert)\ **Post date:** [October 24, 2019, 5:55pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/6 "2019-10-24T17:55:00Z")
@system I noticed that try\_files was included, while further down the config we still set PATHINFO. Doesn’t that cause issues? Due to a bug try\_files resets $fastcgi\_path\_info… [http://trac.nginx.org/nginx/ticket/321](http://trac.nginx.org/nginx/ticket/321) ---
**Author:** ![Xananax](https://help.nextcloud.com/letter_avatar/xananax/32/6_22734026db12803ebb3e059622ac3534.png) [@Xananax](https://help.nextcloud.com/u/Xananax)\ **Post date:** [October 24, 2019, 8:12pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/7 "2019-10-24T20:12:43Z")
On Arch, those directives are `SCRIPT_FILENAME` and `PATH_INFO` (notice the `_` between the words). Got bit once again and spent some time thinking my server was borked. Hope it helps someone else. ---
**Author:** ![TP75](https://help.nextcloud.com/user_avatar/help.nextcloud.com/tp75/32/12565_2.png) [@TP75](https://help.nextcloud.com/u/TP75)\ **Post date:** [October 24, 2019, 8:36pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/8 "2019-10-24T20:36:22Z")
To whom it may concern. > [@system](#): > > In the last 24 hours, a new security risk has emerged around NGINX, documented in CVE-2019-11043. This exploit allows for remote code execution on some NGINX and php-fpm configurations. If you do not run NGINX, this exploit does not effect you. I appreciate such urgent info and the resp. [Nextcloud announcement](https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/). However, for the convenience of administrators and other interested parties one may add several links such as: - [CVE-2019-11043 at MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11043) - [CVE-2019-11043](https://security-tracker.debian.org/tracker/CVE-2019-11043) on the [Debian Security Bug Tracker](https://security-tracker.debian.org/tracker/) - [CVE-2019-11043](https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-11043.html) on the [Ubuntu CVE Tracker](https://launchpad.net/ubuntu-cve-tracker) Beispielhaft sei noch der Artikel [Debian und CVE-Kompatibilität](https://www.debian.org/security/cve-compatibility.de.html) für deutschsprachige Personen erwähnt. - English: [Debian and CVE compatibility](https://www.debian.org/security/cve-compatibility.en.html) 😇 ---
**Author:** ![Reiner\_Nippes](https://help.nextcloud.com/user_avatar/help.nextcloud.com/reiner_nippes/32/9479_2.png) [@Reiner\_Nippes](https://help.nextcloud.com/u/Reiner_Nippes)\ **Post date:** [October 24, 2019, 9:37pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/9 "2019-10-24T21:37:01Z")
> [@fwolfst](#): > > I am sure it will come soon. ```auto php7.3-fpm: Installed: 7.3.11-1+ubuntu18.04.1+deb.sury.org+1 Candidate: 7.3.11-1+ubuntu18.04.1+deb.sury.org+1 Version table: *** 7.3.11-1+ubuntu18.04.1+deb.sury.org+1 500 500 http://ppa.launchpad.net/ondrej/php/ubuntu bionic/main amd64 Packages 100 /var/lib/dpkg/status ``` ---
**Author:** ![PriceChild](https://help.nextcloud.com/user_avatar/help.nextcloud.com/pricechild/32/18577_2.png) [@PriceChild](https://help.nextcloud.com/u/PriceChild)\ **Post date:** [October 24, 2019, 10:48pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/10 "2019-10-24T22:48:49Z")
I got hit by this also, I’m not sure whether `SCRIPTFILENAME` and `PATHINFO` are valid anywhere? I think it might just be a mistake in the blog post? e.g. [https://docs.nextcloud.com/server/17/admin\_manual/installation/nginx.html?highlight=nginx](https://docs.nextcloud.com/server/17/admin_manual/installation/nginx.html?highlight=nginx) has underscores. ---
**Author:** ![MeiRos](https://help.nextcloud.com/user_avatar/help.nextcloud.com/meiros/32/8211_2.png) [@MeiRos](https://help.nextcloud.com/u/MeiRos)\ **Post date:** [October 24, 2019, 11:14pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/11 "2019-10-24T23:14:56Z")
I think this kind of news should be sticky at least few days. Can you do it? @system ---
**Author:** ![Rafal\_Skolasinski](https://help.nextcloud.com/user_avatar/help.nextcloud.com/rafal_skolasinski/32/18580_2.png) [@Rafal\_Skolasinski](https://help.nextcloud.com/u/Rafal_Skolasinski)\ **Post date:** [October 24, 2019, 11:38pm UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/12 "2019-10-24T23:38:41Z")
What about Nextcloud installed via Ubuntu snaps? Did it got all required updates to its nginx automatically? ---
**Author:** ![MeiRos](https://help.nextcloud.com/user_avatar/help.nextcloud.com/meiros/32/8211_2.png) [@MeiRos](https://help.nextcloud.com/u/MeiRos)\ **Post date:** [October 25, 2019, 12:18am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/13 "2019-10-25T00:18:25Z")
Here’s more updates since this news thread was opened. > ---
**Author:** ![mishley](https://help.nextcloud.com/user_avatar/help.nextcloud.com/mishley/32/18582_2.png) [@mishley](https://help.nextcloud.com/u/mishley)\ **Post date:** [October 25, 2019, 12:54am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/14 "2019-10-25T00:54:05Z")
I run a fully-refreshed snap on Ubuntu 16.04. Version information is `installed: 16.0.5snap2 (16402) 228MB` and I do not see nginx running at all. That leads me to believe the version of php-fpm (which _is_ installed) is not a problem. Services from nextcloud snap: ``` $ sudo snap services nextcloud Service Startup Current Notes nextcloud.apache enabled active - nextcloud.mdns-publisher enabled active - nextcloud.mysql enabled active - nextcloud.nextcloud-cron enabled active - nextcloud.nextcloud-fixer enabled inactive - nextcloud.php-fpm enabled active - nextcloud.redis-server enabled active - nextcloud.renew-certs enabled active - ``` ---
**Author:** ![Bernie\_O](https://help.nextcloud.com/user_avatar/help.nextcloud.com/bernie_o/32/40181_2.png) [@Bernie\_O](https://help.nextcloud.com/u/Bernie_O)\ **Post date:** [October 25, 2019, 5:54am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/15 "2019-10-25T05:54:47Z")
> [@Rafal\_Skolasinski](#): > > What about Nextcloud installed via Ubuntu snaps? > Did it got all required updates to its nginx automatically? Nextcloud-Snap comes with Apache and not with nginx, so you should be safe: > **[GitHub - nextcloud-snap/nextcloud-snap: ☁️📦 Nextcloud packaged as a snap](https://github.com/nextcloud-snap/nextcloud-snap#snappy-nextcloud)** > > ☁️📦 Nextcloud packaged as a snap. Contribute to nextcloud-snap/nextcloud-snap development by creating an account on GitHub. ---
**Author:** ![Schmu](https://help.nextcloud.com/user_avatar/help.nextcloud.com/schmu/32/7823_2.png) [@Schmu](https://help.nextcloud.com/u/Schmu)\ **Post date:** [October 25, 2019, 8:37am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/16 "2019-10-25T08:37:52Z")
I’m just wondering (but could be an idiotic thought): are users really safe just because they run apache? I mean, the bug was actually in PHP (not nginx) in combination with php-fpm. Doesn’t apache use php-fpm as well? As said, just wondering. Could be a totally mislead thought. ---
**Author:** ![foxdie](https://help.nextcloud.com/letter_avatar/foxdie/32/6_22734026db12803ebb3e059622ac3534.png) [@foxdie](https://help.nextcloud.com/u/foxdie)\ **Post date:** [October 25, 2019, 9:23am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/17 "2019-10-25T09:23:25Z")
WARNING to everybody with nginx version: nginx/1.10.3 (Debian stretch latest) The directive or cgi\_parameter SCRIPTFILENAME will render your nextcloud website blank. change it to SCRIPT\_FILENAME ---
**Author:** ![PriceChild](https://help.nextcloud.com/user_avatar/help.nextcloud.com/pricechild/32/18577_2.png) [@PriceChild](https://help.nextcloud.com/u/PriceChild)\ **Post date:** [October 25, 2019, 9:37am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/18 "2019-10-25T09:37:52Z")
Are both “Immediate actions” required to be secure? My upstream distribution does not have updated packages available currently. ---
**Author:** ![Bernie\_O](https://help.nextcloud.com/user_avatar/help.nextcloud.com/bernie_o/32/40181_2.png) [@Bernie\_O](https://help.nextcloud.com/u/Bernie_O)\ **Post date:** [October 25, 2019, 9:46am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/19 "2019-10-25T09:46:16Z")
> [@Schmu](#): > > are users really safe just because they run apache? I mean, the bug was actually in PHP (not nginx) in combination with php-fpm. Doesn’t apache use php-fpm as well? > > As said, just wondering. Could be a totally mislead thought. I am relying on this statement from the initial post: > [@system](#): > > If you do not run NGINX, this exploit does not effect you. ---
**Author:** ![kbp](https://help.nextcloud.com/letter_avatar/kbp/32/6_22734026db12803ebb3e059622ac3534.png) [@kbp](https://help.nextcloud.com/u/kbp)\ **Post date:** [October 25, 2019, 9:46am UTC](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665/20 "2019-10-25T09:46:58Z")
Is Nginx (under Plesk) with the directives set from [this guide](https://markus-blog.de/index.php/2019/10/16/how-to-install-nextcloud-17-within-plesk-with-nginx-only/) affected? [Next page](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665.md?page=2)