php-phpseclib3 vulnerabilities (Debian)
12 vulnerabilities.
-
php-phpseclib3Debian phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery 6.3 Medium -
php-phpseclib3Debian phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access 5.8 Medium -
php-phpseclib3Debian phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID() 7.5 High -
php-phpseclib3Debian phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals() 3.7 Low -
php-phpseclib3Debian phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack 8.2 High -
php-phpseclib3Debian Name confusion in x509 Subject Alternative Name fields 7.5 High -
php-phpseclib3Debian phpseclib guardrails needed on OID length 7.5 High -
php-phpseclib3Debian phpseclib: guardrails needed on isPrime and randomPrime 7.5 High -
php-phpseclib3Debian Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin 5.9 Medium -
php-phpseclib3Debian Phpseclib needs guardrails on large binaryfield integers 7.5 High -
php-phpseclib3Debian phpseclib Infinite Loop vulnerability 7.5 High -
php-phpseclib3Debian Improper Certificate Validation in phpseclib 7.5 High