Описание
phpseclib does not properly limit the ASN1 OID length
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2024-27355
- https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59
- https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2024-27355.yaml
- https://github.com/advisories/GHSA-jr22-8qgm-4q87
- https://github.com/phpseclib/phpseclib/blob/978d081fe50ff92879c50ff143c62a143edb0117/phpseclib/File/ASN1.php#L1129
- https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html
Пакеты
phpseclib/phpseclib
>= 3.0.0, < 3.0.36
3.0.36
phpseclib/phpseclib
>= 2.0.0, < 2.0.47
2.0.47
phpseclib/phpseclib
>= 1.0.0, < 1.0.23
1.0.23
Связанные уязвимости
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0 ...
Уязвимость библиотеки криптографических протоколов phpseclib, связанная с неправильной проверкой входных данных, позволяющая нарушителю вызвать отказ в обслуживании
