CVE-2024-27355

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
phpseclib	phpseclib	>= 1.0, < 1.0.23; >= 2.0, < 2.0.47; >= 3.0, < 3.0.36

References

https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0bThird Party Advisory
https://github.com/phpseclib/phpseclib/blob/978d081fe50ff92879c50ff143c62a143edb0117/phpseclib/File/ASN1.php#L1129Product
https://lists.debian.org/debian-lts-announce/2024/03/msg00002.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/03/msg00003.htmlMailing List, Third Party Advisory
https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0bThird Party Advisory
https://github.com/phpseclib/phpseclib/blob/978d081fe50ff92879c50ff143c62a143edb0117/phpseclib/File/ASN1.php#L1129Product
https://lists.debian.org/debian-lts-announce/2024/03/msg00002.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/03/msg00003.htmlMailing List, Third Party Advisory

Timeline

Published: Mar 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-273567.5An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical u CVE-2024-273575.8An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and CVE-2024-273583.3An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security through 23.x for macOS. CVE-2024-273597.5Certain WithSecure products allow a Denial of Service because the engine scanner can go into an infinite loop when processing an archive fil CVE-2024-27365.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up to, and including, CVE-2024-273607.5A vulnerability was discovered in Samsung Mobile Processors Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exy CVE-2024-273614.1A vulnerability was discovered in Samsung Mobile Processor Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exyno CVE-2024-273627.5A vulnerability was discovered in Samsung Mobile Processors Exynos 1280, Exynos 2200, Exynos 1330, Exynos 1380, and Exynos 2400 where they d CVE-2024-273636.0A vulnerability was discovered in Samsung Mobile Processor Exynos 850, Exynos 9610, Exynos 980, Exynos 1280, Exynos 1380, Exynos 1330, Exyno CVE-2024-273645.5An issue was discovered in Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, CVE-2024-273655.5An issue was discovered in Samsung Mobile Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exyno CVE-2024-273665.5An issue was discovered in Samsung Mobile Processor, Wearable Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380