CVE-2023-49316: High severity phpseclib phpseclib vulnerability
Impact Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc)
Patches https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f
Workarounds No.
References https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f https://www.usenix.org/system/files/usenixsecurity25-shi-bing.pdf
Other sources
In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degrees can lead to a denial of service.
— MITRE
In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degrees in binary fields can lead to a denial of service.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-49316?
CVE-2023-49316 is a vulnerability in phpseclib before version 3.0.34 that allows for a denial of service attack due to excessively large degrees in binary fields.
How does CVE-2023-49316 affect phpseclib?
CVE-2023-49316 affects phpseclib versions prior to 3.0.34.
How can CVE-2023-49316 be exploited?
CVE-2023-49316 can be exploited by sending inputs with excessively large degrees in binary fields, leading to a denial of service.
What is the fix for CVE-2023-49316?
The fix for CVE-2023-49316 is to update phpseclib to version 3.0.34 or later.
Where can I find more information about CVE-2023-49316?
More information about CVE-2023-49316 can be found at the following references: [GitHub commit](https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f), [GitHub release](https://github.com/phpseclib/phpseclib/releases/tag/3.0.34), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-49316)