CVE-2023-52892: High severity composer/phpseclib/phpseclib vulnerability
In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52892?
CVE-2023-52892 has been classified as a moderate severity vulnerability affecting specific versions of phpseclib.
How do I fix CVE-2023-52892?
To remediate CVE-2023-52892, upgrade to phpseclib version 1.0.22, 2.0.46, or 3.0.33.
Which versions are affected by CVE-2023-52892?
CVE-2023-52892 affects phpseclib versions before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33.
What problems does CVE-2023-52892 cause in TLS certificates?
CVE-2023-52892 allows certain characters in Subject Alternative Name fields of TLS certificates to be misinterpreted, leading to potential name confusion during X.509 certificate host verification.
Is CVE-2023-52892 related to regular expressions?
Yes, CVE-2023-52892 involves the incorrect handling of special characters in regular expressions within the Subject Alternative Name fields.