GitHub Advisoryadvisory · Packagist

GHSA-hm7p-r324-hhf3 phpseclib Infinite Loop vulnerability

HIGH Published 2023-03-03 Modified 2025-03-06 Official page ↗
Aliases
CVE-2023-27560
Ecosystem
Packagist
Packages
phpseclib/phpseclib
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2023-03-03

Affected packages

• Packagist phpseclib/phpseclib: >= 3.0.0, < 3.0.19 → fixed in 3.0.19

Description

Math/PrimeField.php in phpseclib has an infinite loop with composite primefields. This vulnerability was introduced in version 3.0.0, and has been patched in 3.0.19. The CVE for this issue originally identified the the vulnerable version as 2.x, however, the vulnerable functionality was not introduced until version 3.

Related

Alias · CVE (1)

  • CVE-2023-27560 Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields. vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References