logo

Database

Asymmetric denial of service In phpseclib/phpseclib

Description

phpseclib guardrails needed on OID length

Impact

Any application using that loads untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc).

Patches

https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59

Workarounds

No.

Resources

https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59 https://www.usenix.org/system/files/conference/usenixsecurity25/sec25cycle1-prepub-599-shi-bing.pdf

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 11

10

Aliases

1. CVE-2024-273552. NVD-2024-273553. OSV-DEBIAN-2024-273554. OSV-2024-273555. GHSA-f2qx-66wf-wvvx6. GCVE-2024-273557. SECURITY-TRACKER-CVE-2024-273558. lists.debian.org9. lists.debian.org

References

1. https://github.com/phpseclib/phpseclib/security/advisories/GHSA-f2qx-66wf-wvvx2. https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb593. https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b4. https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2024-27355.yaml5. https://github.com/phpseclib/phpseclib/blob/978d081fe50ff92879c50ff143c62a143edb0117/phpseclib/File/ASN1.php#L1129

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.