GoogleOSV:GHSA-JR22-8QGM-4Q87phpseclib does not properly limit the ASN1 OID length
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).
References
gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b
github.com/advisories/GHSA-jr22-8qgm-4q87
github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2024-27355.yaml
github.com/phpseclib/phpseclib
github.com/phpseclib/phpseclib/blob/978d081fe50ff92879c50ff143c62a143edb0117/phpseclib/File/ASN1.php#L1129
github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59
lists.debian.org/debian-lts-announce/2024/03/msg00002.html
lists.debian.org/debian-lts-announce/2024/03/msg00003.html
nvd.nist.gov/vuln/detail/CVE-2024-27355
Related
