CVE-2023-52892: Name confusion in x509 Subject Alternative Name fields in phpseclib
Summary
CVE-2023-52892: Name confusion in x509 Subject Alternative Name fields. Affects phpseclib/phpseclib across 3 version ranges.
< 1.0.22
>= 2.0.0, < 2.0.46
>= 3.0.0, < 3.0.33
Fixed in 1.0.22, 2.0.46 or 3.0.33, depending on the release line you run. How to fix ↓
Also tracked for
- php-phpseclib · Debian:11
The same CVE-2023-52892 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpseclib is a PHP library that provides a secure implementation of various cryptographic protocols, including SSH, SFTP, and TLS. It is widely used in PHP applications for secure communication. However, a vulnerability has been discovered in versions before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33 of phpseclib. This vulnerability allows certain characters in the Subject Alternative Name fields of TLS certificates to be incorrectly interpreted as special characters in regular expressions, leading to name confusion in X.509 certificate host verification.
Vulnerability Detail
The vulnerability arises from the incorrect interpretation of certain characters in the Subject Alternative Name fields of TLS certificates. These characters, which should be treated as literal characters, are mistakenly allowed to have a special meaning in regular expressions. This can result in name confusion during X.509 certificate host verification. An attacker could exploit this vulnerability to bypass certificate validation and potentially perform man-in-the-middle attacks or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.0.221.0.22composer require phpseclib/phpseclib:1.0.22 -
>= 2.0.0, < 2.0.462.0.46composer require phpseclib/phpseclib:2.0.46 -
>= 3.0.0, < 3.0.333.0.33composer require phpseclib/phpseclib:3.0.33
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the phpseclib library to the fixed version as soon as possible.
Conclusion
The vulnerability in phpseclib allows for name confusion in X.509 certificate host verification, potentially leading to man-in-the-middle attacks or other malicious activities. It is crucial to update the library to the fixed version to mitigate this vulnerability.
See every vulnerability recorded for phpseclib/phpseclib →
FAQ
phpseclib is a PHP library that provides a secure implementation of various cryptographic protocols, including SSH, SFTP, and TLS.
The vulnerability allows for name confusion in X.509 certificate host verification, potentially enabling man-in-the-middle attacks or other malicious activities.
Versions before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33 of phpseclib are affected.
To fix this vulnerability, update phpseclib to version 1.0.22 or later (for versions before 1.0.22), version 2.0.46 or later (for versions 2.x before 2.0.46), or version 3.0.33 or later (for versions 3.x before 3.0.33).
No, there is no known workaround. Updating the library to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpseclib/phpseclib.
