Steps to reproduce

Run composer audit

You'll see the phpseclib/phpseclib package as a dependency with vulnerable version

+-------------------+----------------------------------------------------------------------------------+
| Package           | phpseclib/phpseclib                                                              |
| Severity          | high                                                                             |
| CVE               | CVE-2024-27354                                                                   |
| Title             | phpseclib a large prime can cause a denial of service                            |
| URL               | https://github.com/advisories/GHSA-hg35-mp25-qf6h                                |
| Affected versions | >=3.0.0,<3.0.36|>=2.0.0,<2.0.47|>=1.0.0,<1.0.23                                  |
| Reported at       | 2024-03-02T00:31:33+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | phpseclib/phpseclib                                                              |
| Severity          | high                                                                             |
| CVE               | CVE-2024-27355                                                                   |
| Title             | phpseclib does not properly limit the ASN1 OID length                            |
| URL               | https://github.com/advisories/GHSA-jr22-8qgm-4q87                                |
| Affected versions | >=3.0.0,<3.0.36|>=2.0.0,<2.0.47|>=1.0.0,<1.0.23                                  |
| Reported at       | 2024-03-02T00:31:33+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

Proposed resolution

Update composer to use newer version of the phpseclib/phpseclib library eg.: ^3.0.36

Comments

endrukk created an issue. See original summary.

endrukk’s picture

endrukk’s picture

Here is a patch that requires a higher version of the dependency.

endrukk’s picture

Status: Active » Needs review

  • 59cb5b72 committed on 1.x
    Issue #3460836 by endrukk, John Franklin: Update composer.json to use...
john franklin’s picture

Status: Needs review » Fixed

Fixed, thanks for the patch!

john franklin’s picture

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.