logo

Database

Insecure digital certificates In phpseclib/phpseclib

Description

Improper Certificate Validation in phpseclib phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 11

10

Aliases

1. CVE-2021-301302. NVD-2021-301303. OSV-DEBIAN-2021-301304. OSV-2021-301305. GCVE-2021-301306. SECURITY-TRACKER-CVE-2021-301307. lists.debian.org8. lists.debian.org

References

1. https://github.com/phpseclib/phpseclib/pull/16352. https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2021-30130.yaml3. https://github.com/phpseclib/phpseclib/releases/tag/2.0.314. https://github.com/phpseclib/phpseclib/releases/tag/3.0.7

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.