phpseclib does not properly limit the ASN1 OID length

Description An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID). References https://nvd.nist.gov/vuln/detail/CVE-2024-27355 https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b https://github.com/phpseclib/phpseclib/blob/978d081fe50ff92879c50ff143c62a143edb0117/phpseclib/File/ASN1.php#L1129 phpseclib/phpseclib@e325310 https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2024-27355.yaml GHSA-jr22-8qgm-4q87