CVE-2023-52892

In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incor...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2023-52892 php-phpseclib
Ubuntu UBUNTU-CVE-2023-52892 php-phpseclib 修正版: 2.0.1-1ubuntu0.1~esm2

参照URL

advisory github.com
advisory nvd.nist.gov
package github.com
patch github.com
report github.com
web github.com