CVE-2024-27354

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-27354", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-04-22T15:44:47.697Z", "dateReserved": "2024-02-25T00:00:00.000Z", "datePublished": "2024-03-01T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-03-05T15:06:04.069Z"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality check). NOTE: this issue was introduced when attempting to fix CVE-2023-27560."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49"}, {"url": "https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b"}, {"name": "[debian-lts-announce] 20240305 [SECURITY] [DLA 3749-1] phpseclib security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html"}, {"name": "[debian-lts-announce] 20240305 [SECURITY] [DLA 3750-1] php-phpseclib security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "affected": [{"vendor": "phpseclib", "product": "1x", "cpes": ["cpe:2.3:a:phpseclib:1x:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.0.23", "versionType": "custom"}]}, {"vendor": "phpseclib", "product": "2x", "cpes": ["cpe:2.3:a:phpseclib:2x:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.0.47", "versionType": "custom"}]}, {"vendor": "phpseclib", "product": "3x", "cpes": ["cpe:2.3:a:phpseclib:3x:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0.36", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-03-06T15:59:46.617242Z", "id": "CVE-2024-27354", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-22T15:44:47.697Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:34:51.419Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20240305 [SECURITY] [DLA 3749-1] phpseclib security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html"}, {"name": "[debian-lts-announce] 20240305 [SECURITY] [DLA 3750-1] php-phpseclib security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html"}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-27354", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-04-22T15:44:47.697Z", "dateReserved": "2024-02-25T00:00:00.000Z", "datePublished": "2024-03-01T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-03-05T15:06:04.069Z"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality check). NOTE: this issue was introduced when attempting to fix CVE-2023-27560."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49"}, {"url": "https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b"}, {"name": "[debian-lts-announce] 20240305 [SECURITY] [DLA 3749-1] phpseclib security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html"}, {"name": "[debian-lts-announce] 20240305 [SECURITY] [DLA 3750-1] php-phpseclib security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:34:51.419Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20240305 [SECURITY] [DLA 3749-1] phpseclib security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html"}, {"name": "[debian-lts-announce] 20240305 [SECURITY] [DLA 3750-1] php-phpseclib security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html"}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-27354", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-06T15:59:46.617242Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:phpseclib:1x:*:*:*:*:*:*:*:*"], "vendor": "phpseclib", "product": "1x", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.23", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:phpseclib:2x:*:*:*:*:*:*:*:*"], "vendor": "phpseclib", "product": "2x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.47", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:phpseclib:3x:*:*:*:*:*:*:*:*"], "vendor": "phpseclib", "product": "3x", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.36", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T15:00:54.373Z"}}]}}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}, {"affectedData": [{"cpes": ["cpe:2.3:a:phpseclib:1x:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "1x", "vendor": "phpseclib", "versions": [{"lessThan": "1.0.23", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:phpseclib:2x:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "2x", "vendor": "phpseclib", "versions": [{"lessThan": "2.0.47", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:phpseclib:3x:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "3x", "vendor": "phpseclib", "versions": [{"lessThan": "3.0.36", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*", "matchCriteriaId": "A566C1D0-4B65-4023-80A8-923CC0B656E5", "versionEndExcluding": "1.0.23", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4B6DD8F-121D-40A5-BB9B-D76F01042563", "versionEndExcluding": "2.0.47", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:phpseclib:phpseclib:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D4B508-CF51-4C6A-8FF3-F09A7117E613", "versionEndExcluding": "3.0.36", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an isPrime primality check). NOTE: this issue was introduced when attempting to fix CVE-2023-27560."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en phpseclib 1.x anterior a 1.0.23, 2.x anterior a 2.0.47 y 3.x anterior a 3.0.36. Un atacante puede crear un certificado con formato incorrecto que contenga un valor principal extremadamente grande para provocar una denegaci\u00f3n de servicio (consumo de CPU para una verificaci\u00f3n de primalidad de isPrime). NOTA: este problema se introdujo al intentar solucionar CVE-2023-27560."}], "id": "CVE-2024-27354", "lastModified": "2026-06-17T07:19:42.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-27354", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-03-06T15:59:46.617242Z", "version": "2.0.3"}}]}, "published": "2024-03-01T23:15:08.500", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/katzj/ee72f3c2a00590812b2ea3c0c8890e0b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/phpseclib/phpseclib/blob/master/phpseclib/Math/PrimeField.php#L49"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00002.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00003.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}