CVE-2024-27354

An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate co...

Original description

The description as published by the source.

An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality check). NOTE: this issue was introduced when attempting to fix CVE-2023-27560.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2024-27354 php-phpseclib Fixed in: 2.0.30-2+deb11u2
Ubuntu UBUNTU-CVE-2024-27354 php-phpseclib Fixed in: 2.0.1-1ubuntu0.1~esm2

References

advisory github.com
advisory nvd.nist.gov
web gist.github.com
web github.com
web lists.debian.org
web lists.debian.org