CVE-2024-27354

{"id": "CVE-2024-27354", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-03-01T23:15:08.500", "references": [{"url": "https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality check). NOTE: this issue was introduced when attempting to fix CVE-2023-27560."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en phpseclib 1.x anterior a 1.0.23, 2.x anterior a 2.0.47 y 3.x anterior a 3.0.36. Un atacante puede crear un certificado con formato incorrecto que contenga un valor principal extremadamente grande para provocar una denegaci\u00f3n de servicio (consumo de CPU para una verificaci\u00f3n de primalidad de isPrime). NOTA: este problema se introdujo al intentar solucionar CVE-2023-27560."}], "lastModified": "2025-09-15T17:58:58.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A566C1D0-4B65-4023-80A8-923CC0B656E5", "versionEndExcluding": "1.0.23", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4B6DD8F-121D-40A5-BB9B-D76F01042563", "versionEndExcluding": "2.0.47", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96D4B508-CF51-4C6A-8FF3-F09A7117E613", "versionEndExcluding": "3.0.36", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}