Debian 10 Buster: DLA-3750-1 php-phpseclib DoS Issues Details
debian lts
March 5, 2024
Security issues were discovered in php-phpseclib, a PHP library for arbitrary-precision integer arithmetic, which could lead to Denial of Service
Topics Covered
Summary
CVE-2024-27354
An attacker can construct a malformed certificate containing an
extremely large prime to cause a denial of service (CPU consumption
for an `isPrime` primality check).
This issue was introduced when attempting to fix CVE-2023-27560.
CVE-2024-27355
When processing the ASN.1 object identifier of a certificate, a sub
identifier may be provided that leads to a denial of service (CPU
consumption for `decodeOID`).
For Debian 10 buster, these problems have been fixed in version
2.0.30-2~deb10u3.
We recommend that you upgrade your php-phpseclib packages.
For the detailed security status of php-phpseclib please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/php-phpseclib
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
PREVIOUS
NEXT
Severity
critical
Lowest
Low
Medium
High
Critical
Package: php-phpseclib
Version: 2.0.30-2~deb10u3
CVE ID: CVE-2024-27354 CVE-2024-27355
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!