high7.5
CVE-2024-27355
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36.
Impact
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | phpseclib/phpseclib | >= 2.0.0, <= 2.0.46 | 2.0.47 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phpseclib | Phpseclib | from 1.0.0 before 1.0.23 from 2.0.0 before 2.0.47 from 3.0.0 before 3.0.36 |
| Debian | Debian Linux | Version 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-f2qx-66wf-wvvx
- https://github.com/phpseclib/phpseclib/security/advisories/GHSA-f2qx-66wf-wvvx
- https://nvd.nist.gov/vuln/detail/CVE-2024-27355
- https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59
- https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2024-27355.yaml
- https://github.com/phpseclib/phpseclib/blob/978d081fe50ff92879c50ff143c62a143edb0117/phpseclib/File/ASN1.php#L1129
- https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html