CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
15.5%
phpseclib/phpseclib is vulnerable to a Denial Of Service (DoS). The vulnerability is due to a flaw in handling malformed certificates in the phpseclib/Math/BigInteger.php file by using the method isPrime(). It allows an attacker to trigger excessive CPU consumption during the isPrime primality check.
gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b
github.com/advisories/GHSA-hg35-mp25-qf6h
github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49
github.com/phpseclib/phpseclib/commit/ad5dbdf2129f5e0fb644637770b7f33de8ca8575
lists.debian.org/debian-lts-announce/2024/03/msg00002.html
lists.debian.org/debian-lts-announce/2024/03/msg00003.html