CVE-2024-27355: phpseclib ASN1 OID Length Limitation Vulnerability
Summary
CVE-2024-27355: phpseclib does not properly limit the ASN1 OID length. Affects phpseclib/phpseclib across 3 version ranges.
>= 1.0.0, < 1.0.23
>= 2.0.0, < 2.0.47
>= 3.0.0, < 3.0.36
Fixed in 1.0.23, 2.0.47 or 3.0.36, depending on the release line you run. How to fix ↓
Also tracked for
- php-phpseclib · Debian:11
The same CVE-2024-27355 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpseclib is an open-source PHP library that provides a secure and easy-to-use interface for various cryptographic operations. It is widely used for implementing secure communication protocols, such as SSH, SFTP, and TLS. The library offers a range of functions and classes for working with encryption, digital signatures, certificates, and more. However, a vulnerability has been discovered in versions 1.x, 2.x, and 3.x of phpseclib that could lead to a denial of service (CPU consumption) when processing the ASN.1 object identifier of a certificate.
Vulnerability Detail
The vulnerability arises from a lack of proper limitation on the length of the ASN1 OID (Object Identifier) in a certificate. An attacker can provide a sub identifier that triggers excessive CPU consumption during the decoding process. This can result in a denial of service condition, where the affected system becomes unresponsive or slows down significantly. The vulnerability affects all versions of phpseclib prior to 1.0.23, 2.0.47, and 3.0.36.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.231.0.23composer require phpseclib/phpseclib:1.0.23 -
>= 2.0.0, < 2.0.472.0.47composer require phpseclib/phpseclib:2.0.47 -
>= 3.0.0, < 3.0.363.0.36composer require phpseclib/phpseclib:3.0.36
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The phpseclib ASN1 OID Length Limitation Vulnerability can be mitigated by updating the library to the latest version. It is crucial to keep software dependencies up to date to ensure the security and stability of applications. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpseclib/phpseclib →
FAQ
phpseclib is an open-source PHP library that provides a secure and easy-to-use interface for various cryptographic operations.
ASN.1 OID (Object Identifier) is a standardized format for representing and identifying objects in a network protocol or cryptographic context.
The vulnerability can lead to a denial of service condition, causing the affected system to become unresponsive or significantly slow down.
All versions of phpseclib prior to 1.0.23, 2.0.47, and 3.0.36 are affected.
To fix this vulnerability, update phpseclib to version 1.0.23, 2.0.47, or 3.0.36, depending on the version you are using.
Related vulnerabilities
Recent vulnerabilities recorded for phpseclib/phpseclib.
