How to fix PHP-FPM + Nginx vulnerability issue?

Question

PHP

Actually news: https://www.opennet.ru/opennews/art.shtml?num=51749
My config

location ~ \.php$ {
                limit_req zone=php2zone burst=5 nodelay;
                try_files $uri =404;
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
                fastcgi_index index.php;
                fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
                include fastcgi_params;
    }

Did I understand correctly that try_files $fastcgi_script_name=404 should be added after fastcgi_split_path_info ? or try_files $document_root$fastcgi_script_name=404

Answer 1

This config is invulnerable
What, in fact, is written at the link.

Answer 2

Just update php-fpm

Answer 3

Refresh and forget.

Answer 4

in php.ini set cgi.fix_pathinfo=0
And if through nginx then

location ~ \.php$ {
        try_files $fastcgi_script_name =404;
  fastcgi_index			index.php;
  fastcgi_param			script_FILENAME /scripts$fastcgi_script_name;
  include				fastcgi_params;
}

Answer 5

I recommend using this site