SB2026041033 - Information Exposure Through Timing Discrepancy in phpseclib

Description

This security bulletin contains information about 1 security vulnerability.

1) Information Exposure Through Timing Discrepancy (CVE-ID: N/A)

The vulnerability allows a remote attacker to disclose limited security-sensitive information via a timing side channel.

The vulnerability exists due to observable timing discrepancy in SSH2::get_binary_packet() in phpseclib/Net/SSH2.php when verifying received SSH packet HMAC values. A remote attacker can send specially crafted SSH packets to disclose limited security-sensitive information via a timing side channel.

The vulnerable code path is reached for non-AEAD cipher and MAC combinations, while AEAD cipher modes use a different authentication path.

Remediation

Install update from vendor's website.

References

• https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qx
• https://github.com/advisories/GHSA-r854-jrxh-36qx