GHSA-ff7q-6vwh-v9m4
Name confusion in x509 Subject Alternative Name fields
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | phpseclib/phpseclib | < 1.0.22 | 1.0.22 |
| Packagist | phpseclib/phpseclib | >= 2.0.0, < 2.0.46 | 2.0.46 |
| Packagist | phpseclib/phpseclib | >= 3.0.0, < 3.0.33 | 3.0.33 |
Details
As written in the advisory (Markdown source, shown as plain text).
In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-52892
- https://github.com/phpseclib/phpseclib/issues/1943
- https://github.com/phpseclib/phpseclib/commit/6cd6e8ceab9f2b55c8cd81d2192bf98cbeaf4627
- https://github.com/phpseclib/phpseclib
- https://github.com/phpseclib/phpseclib/releases/tag/3.0.33
- https://github.com/x509-name-testing/name_testing_artifacts