CVE-2024-27355

An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).

References

Affected packages

Git / github.com/phpseclib/phpseclib

Affected ranges

Type

GIT

Repo

https://github.com/phpseclib/phpseclib

Events

Introduced

844134df95e42b93ed5506a2d11ca5accda99412

Fixed

86990d518f4434719271fadd112d34b20208f3a9

Introduced

a74aa9efbe61430fcb60157c8e025a48ec8ff604

Fixed

b7d7d90ee7df7f33a664b4aea32d50a305d35adb

Introduced

fe62c85e0203503231d489af95d0ac053b7d3575

Fixed

c2fb5136162d4be18fdd4da9980696f3aee96d7b

Database specific

{
    "versions": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.0.23"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.0.47"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.36"
        }
    ]
}

Affected versions

2.*

2.0.0

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.0.18

2.0.19

2.0.20

2.0.21

2.0.22

2.0.23

2.0.24

2.0.25

2.0.26

2.0.27

2.0.28

2.0.29

2.0.3

2.0.30

2.0.31

2.0.32

2.0.33

2.0.34

2.0.35

2.0.36

2.0.37

2.0.38

2.0.39

2.0.4

2.0.40

2.0.41

2.0.42

2.0.43

2.0.44

2.0.45

2.0.46

2.0.5

2.0.6

2.0.7

2.0.9

3.*

3.0.0

3.0.1

3.0.10

3.0.11

3.0.12

3.0.13

3.0.14

3.0.15

3.0.16

3.0.17

3.0.18

3.0.19

3.0.2

3.0.20

3.0.21

3.0.22

3.0.23

3.0.3

3.0.33

3.0.34

3.0.35

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27355.json"