Lucene search

K
friendsofphpOpenJS FoundationFRIENDSOFPHP:PHPSECLIB:PHPSECLIB:CVE-2023-27560
HistoryMar 06, 2023 - 9:20 a.m.

Infinite Loop vulnerability

2023-03-0609:20:00
OpenJS Foundation
github.com
5
infinite loop
phpseclib
math/primefield.php
composite primefields
cve-2023-27560
vulnerability
patched

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

41.1%

Description Math/PrimeField.php in phpseclib has an infinite loop with composite primefields. This vulnerability was introduced in version 3.0.0, and has been patched in 3.0.19. The CVE for this issue originally identified the the vulnerable version as 2.x, however, the vulnerable functionality was not introduced until version 3. References https://nvd.nist.gov/vuln/detail/CVE-2023-27560 phpseclib/phpseclib@6298d1c phpseclib/phpseclib@6298d1c#commitcomment-103226722 https://github.com/phpseclib/phpseclib/releases/tag/3.0.19 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2023-27560.yaml

Affected configurations

Vulners
Node
phpseclibphpseclibRange<3.0.19
VendorProductVersionCPE
phpseclibphpseclib*cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

41.1%