Input validation error in phpseclib - CVE-2023-52892

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU108060

Input validation error in phpseclib - CVE-2023-52892

Published: April 29, 2025 / Updated: May 21, 2026


Vulnerability identifier: #VU108060
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-52892
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when handling some characters in Subject Alternative Name fields in TLS certificates. These fields are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.


Affected software

phpseclib
Ubuntu
Fedora
php-phpseclib (Ubuntu package)
php-phpseclib

How to mitigate CVE-2023-52892

Install updates from vendor's website.

phpseclib - addressed in versions 1.0.22, 2.0.46, 3.0.33
php-phpseclib (Ubuntu package) - addressed in versions 1.0.1-3ubuntu0.1+esm1, 1.0.9-1ubuntu0.1~esm1, 1.0.18-2ubuntu0.1~esm1, 1.0.20-1ubuntu0.1~esm1, 2.0.1-1ubuntu0.1~esm2, 2.0.9-1ubuntu0.1~esm2, 2.0.23-2ubuntu0.1~esm2, 2.0.36-1ubuntu0.1~esm2, 3.0.13-1ubuntu0.1~esm1
php-phpseclib - addressed in versions 2.0.48-1.fc40, 2.0.48-1.fc41

External References

Related Security Bulletins