high7.5
CVE-2024-27354
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36.
Impact
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality check). NOTE: this issue was introduced when attempting to fix CVE-2023-27560.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | phpseclib/phpseclib | >= 0.1.1, < 1.0.23 | 1.0.23 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phpseclib | Phpseclib | from 1.0.0 before 1.0.23 from 2.0.0 before 2.0.47 from 3.0.0 before 3.0.36 |
| Debian | Debian Linux | Version 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-2528-jw5q-ww88
- https://github.com/phpseclib/phpseclib/security/advisories/GHSA-2528-jw5q-ww88
- https://nvd.nist.gov/vuln/detail/CVE-2024-27354
- https://github.com/phpseclib/phpseclib/commit/2870c8fab3f132d2ed40a66c97a36fe5ab625698
- https://github.com/phpseclib/phpseclib/commit/ad5dbdf2129f5e0fb644637770b7f33de8ca8575
- https://github.com/phpseclib/phpseclib/commit/c55b75199ec8d12cec6eadf6da99da4a3712fe56
- https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2024-27354.yaml
- https://github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49
- https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html