Denial of Service Vulnerability in phpseclib: ASN.1 Object Identifier Processing
Summary
CVE-2024-27355: An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. Affects php-phpseclib across 2 version ranges.
< 2.0.30-2+deb11u2
< 86990d518f4434719271fadd112d34b20208f3a9
Fixed in 2.0.30-2+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpseclib is a popular open-source library for secure communications in PHP, providing various cryptographic functionalities such as encryption, decryption, and secure key management. The library is widely used in applications requiring secure data transmission. However, certain versions of phpseclib are vulnerable to a denial of service attack due to improper handling of ASN.1 object identifiers in certificates, which can lead to excessive CPU consumption during processing.
Vulnerability Detail
An issue was discovered in phpseclib versions 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. The vulnerability arises when the library processes the ASN.1 object identifier of a certificate. A sub-identifier may be provided that causes the decodeOID function to consume excessive CPU resources, leading to a denial of service. This can be exploited by an attacker to disrupt the availability of applications relying on phpseclib for secure communications.
How To Fix
Minimum fixed version
2.0.30-2+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-phpseclibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not possible, consider implementing rate limiting on the input to the ASN.1 processing functions to mitigate the impact of potential denial of service attacks. This can help control the CPU usage by limiting the number of requests processed in a given timeframe.
Conclusion
The CVE-2024-27355 vulnerability in phpseclib poses a significant risk of denial of service due to improper handling of ASN.1 object identifiers. It is crucial for users of affected versions to upgrade to the patched releases to ensure the security and availability of their applications. Implementing workarounds such as rate limiting can provide temporary relief until an upgrade is feasible.
See every vulnerability recorded for php-phpseclib →
FAQ
The vulnerability can lead to denial of service by consuming excessive CPU resources, potentially disrupting the availability of applications using phpseclib.
Affected versions include phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, implementing rate limiting on the input to ASN.1 processing functions can help control CPU usage and mitigate the impact of the vulnerability.
More information can be found in the CVE details and the official phpseclib repository on GitHub.
Related vulnerabilities
Recent vulnerabilities recorded for php-phpseclib.
