phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()
The advisory, in context
Impact
Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc)
Patches
https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc
Workarounds
No.
References
https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 0.1.1 before 1.0.29
Fixed in 1.0.29
37 explicitly affected versions
0.3.0, 0.3.1, 0.3.10, 0.3.5, 0.3.6, 0.3.7, 0.3.8, 0.3.9, 1.0.0, 1.0.1, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.2, 1.0.20, 1.0.21, 1.0.22, 1.0.23, 1.0.24, 1.0.25, 1.0.26, 1.0.27, 1.0.28, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0.1.1"
},
{
"fixed": "1.0.29"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.3.0",
"0.3.1",
"0.3.10",
"0.3.5",
"0.3.6",
"0.3.7",
"0.3.8",
"0.3.9",
"1.0.0",
"1.0.1",
"1.0.10",
"1.0.11",
"1.0.12",
"1.0.13",
"1.0.14",
"1.0.15",
"1.0.16",
"1.0.17",
"1.0.18",
"1.0.19",
"1.0.2",
"1.0.20",
"1.0.21",
"1.0.22",
"1.0.23",
"1.0.24",
"1.0.25",
"1.0.26",
"1.0.27",
"1.0.28",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.6",
"1.0.7",
"1.0.8",
"1.0.9"
]
}From 2.0.0 before 2.0.54
Fixed in 2.0.54
54 explicitly affected versions
2.0.0, 2.0.1, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.0.19, 2.0.2, 2.0.20, 2.0.21, 2.0.22, 2.0.23, 2.0.24, 2.0.25, 2.0.26, 2.0.27, 2.0.28, 2.0.29, 2.0.3, 2.0.30, 2.0.31, 2.0.32, 2.0.33, 2.0.34, 2.0.35, 2.0.36, 2.0.37, 2.0.38, 2.0.39, 2.0.4, 2.0.40, 2.0.41, 2.0.42, 2.0.43, 2.0.44, 2.0.45, 2.0.46, 2.0.47, 2.0.48, 2.0.49, 2.0.5, 2.0.50, 2.0.51, 2.0.52, 2.0.53, 2.0.6, 2.0.7, 2.0.8, 2.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.54"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.0",
"2.0.1",
"2.0.10",
"2.0.11",
"2.0.12",
"2.0.13",
"2.0.14",
"2.0.15",
"2.0.16",
"2.0.17",
"2.0.18",
"2.0.19",
"2.0.2",
"2.0.20",
"2.0.21",
"2.0.22",
"2.0.23",
"2.0.24",
"2.0.25",
"2.0.26",
"2.0.27",
"2.0.28",
"2.0.29",
"2.0.3",
"2.0.30",
"2.0.31",
"2.0.32",
"2.0.33",
"2.0.34",
"2.0.35",
"2.0.36",
"2.0.37",
"2.0.38",
"2.0.39",
"2.0.4",
"2.0.40",
"2.0.41",
"2.0.42",
"2.0.43",
"2.0.44",
"2.0.45",
"2.0.46",
"2.0.47",
"2.0.48",
"2.0.49",
"2.0.5",
"2.0.50",
"2.0.51",
"2.0.52",
"2.0.53",
"2.0.6",
"2.0.7",
"2.0.8",
"2.0.9"
]
}From 3.0.0 before 3.0.52
Fixed in 3.0.52
43 explicitly affected versions
3.0.0, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.2, 3.0.20, 3.0.21, 3.0.22, 3.0.23, 3.0.3, 3.0.33, 3.0.34, 3.0.35, 3.0.36, 3.0.37, 3.0.38, 3.0.39, 3.0.4, 3.0.40, 3.0.41, 3.0.42, 3.0.43, 3.0.44, 3.0.45, 3.0.46, 3.0.47, 3.0.48, 3.0.49, 3.0.5, 3.0.50, 3.0.51, 3.0.6, 3.0.7, 3.0.8, 3.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.52"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0",
"3.0.1",
"3.0.10",
"3.0.11",
"3.0.12",
"3.0.13",
"3.0.14",
"3.0.15",
"3.0.16",
"3.0.17",
"3.0.18",
"3.0.19",
"3.0.2",
"3.0.20",
"3.0.21",
"3.0.22",
"3.0.23",
"3.0.3",
"3.0.33",
"3.0.34",
"3.0.35",
"3.0.36",
"3.0.37",
"3.0.38",
"3.0.39",
"3.0.4",
"3.0.40",
"3.0.41",
"3.0.42",
"3.0.43",
"3.0.44",
"3.0.45",
"3.0.46",
"3.0.47",
"3.0.48",
"3.0.49",
"3.0.5",
"3.0.50",
"3.0.51",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9"
]
}