CVE-2024-27355

2024-03-0100:00:00

mitre

github.com

phpseclib

denial of service

asn.1

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*"
    ],
    "vendor": "phpseclib",
    "product": "phpseclib",
    "versions": [
      {
        "status": "affected",
        "version": "1.0",
        "lessThan": "1.0.23",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.0",
        "lessThan": "2.0.47",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "3.0",
        "lessThan": "3.0.36",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]