HIGH7.5
GHSA-3qpq-r242-jqj7
phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()
Quick fix
GHSA-3qpq-r242-jqj7 — phpseclib/phpseclib: upgrade to the fixed version with the command below.
composer require phpseclib/phpseclib:^1.0.29Details
### Impact Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc)
### Patches https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc
### Workarounds No.
### References https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/phpseclib/phpseclib
Introduced in:
0.1.1Fixed in: 1.0.29Fix
composer require phpseclib/phpseclib:^1.0.29Packagist/phpseclib/phpseclib
Introduced in:
2.0.0Fixed in: 2.0.54Fix
composer require phpseclib/phpseclib:^2.0.54Packagist/phpseclib/phpseclib
Introduced in:
3.0.0Fixed in: 3.0.52Fix
composer require phpseclib/phpseclib:^3.0.52