CVE-2023-52892

In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incor...

Original description

The description as published by the source.

In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-52892 php-phpseclib
Ubuntu UBUNTU-CVE-2023-52892 php-phpseclib Fixed in: 2.0.1-1ubuntu0.1~esm2

References

advisory github.com
advisory nvd.nist.gov
package github.com
patch github.com
report github.com
web github.com