CVE-2021-30130: Improper Certificate Validation in phpseclib

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-30130.

Q: What is the title of this vulnerability?

The title of this vulnerability is 'Improper Certificate Validation in phpseclib'.

Q: What is the description of this vulnerability?

This vulnerability refers to phpseclib before 2.0.31 and 3.x before 3.0.7 mishandling RSA PKCS#1 v1.5 signature verification.

Q: What is the severity of CVE-2021-30130?

The severity of CVE-2021-30130 is high with a CVSS score of 7.5.

Q: What software versions are affected by this vulnerability?

The affected software versions include phpseclib 2.0.0 up to exclusive 2.0.31 and phpseclib 3.0.0 from inclusive up to exclusive 3.0.7.

Q: How can I fix this vulnerability?

To fix this vulnerability, update your phpseclib package to version 2.0.31 or version 3.0.7.

Published Apr 6, 2021

Updated

Improper Certificate Validation in phpseclib

Other sources

phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.

— GitHub

Affected Software

11 affected componentsFixes available

composer/phpseclib/phpseclib<2.0.31, >=3.0.0, <3.0.7

composer/phpseclib/phpseclib<2.0.31

2.0.31

composer/phpseclib/phpseclib>=3.0.0<3.0.7

3.0.7

phpseclib phpseclib<2.0.31

phpseclib phpseclib>=3.0<3.0.7

Debian Debian Linux=10.0

debian/php-phpseclib

2.0.30-2+deb11u22.0.30-2+deb11u12.0.42-1+deb12u22.0.42-1+deb12u12.0.48-3

debian/php-phpseclib3

3.0.19-1+deb12u33.0.19-1+deb12u23.0.43-2

debian/phpseclib

1.0.19-3+deb11u21.0.19-3+deb11u11.0.20-1+deb12u21.0.20-1+deb12u11.0.23-6

composer/phpseclib/phpseclib<2.0.31

2.0.31

composer/phpseclib/phpseclib>=3.0.0, <3.0.7

3.0.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/phpseclib/phpseclib to a version that resolves this vulnerability.
Fixed in 2.0.31
Upgrade
Upgrade composer/phpseclib/phpseclib to a version that resolves this vulnerability.
Fixed in 3.0.7
Upgrade
Upgrade debian/php-phpseclib to a version that resolves this vulnerability.
Fixed in 2.0.30-2+deb11u2Fixed in 2.0.30-2+deb11u1Fixed in 2.0.42-1+deb12u2Fixed in 2.0.42-1+deb12u1Fixed in 2.0.48-3
Upgrade
Upgrade debian/php-phpseclib3 to a version that resolves this vulnerability.
Fixed in 3.0.19-1+deb12u3Fixed in 3.0.19-1+deb12u2Fixed in 3.0.43-2
Upgrade
Upgrade debian/phpseclib to a version that resolves this vulnerability.
Fixed in 1.0.19-3+deb11u2Fixed in 1.0.19-3+deb11u1Fixed in 1.0.20-1+deb12u2Fixed in 1.0.20-1+deb12u1Fixed in 1.0.23-6
Upgrade
Upgrade phpseclib to a version that resolves this vulnerability.
Fixed in 2.0.31
Upgrade
Upgrade phpseclib to a version that resolves this vulnerability.
Fixed in 3.0.7

Event History

Apr 6, 2021

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Advisory Published

via Packagist·01:43 PM

Data Sourced

via Packagist·01:43 PM

DescriptionSeverityAffected Software

Advisory Published

02:00 PM

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-30130.

What is the title of this vulnerability?