CVE-2024-27355: High severity phpseclib phpseclib vulnerability
Impact Any application using that loads untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc).
Patches https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59
Workarounds No.
Resources https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59 https://www.usenix.org/system/files/conference/usenixsecurity25/sec25cycle1-prepub-599-shi-bing.pdf
Other sources
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27355?
CVE-2024-27355 is classified as a denial of service vulnerability due to excessive CPU consumption.
How do I fix CVE-2024-27355?
To mitigate CVE-2024-27355, upgrade to phpseclib version 1.0.23, 2.0.47, or 3.0.36.
What versions of phpseclib are affected by CVE-2024-27355?
CVE-2024-27355 affects phpseclib versions before 1.0.23, 2.0.47, and 3.0.36.
What is the cause of CVE-2024-27355?
CVE-2024-27355 is caused by improper processing of the ASN.1 object identifier of a certificate.
Can CVE-2024-27355 lead to system exploitation?
CVE-2024-27355 does not lead to system exploitation but can result in service interruption due to high CPU usage.