Name confusion in x509 Subject Alternative Name fields
High severity
GitHub Reviewed
Published
Jun 28, 2024
to the GitHub Advisory Database
•
Updated Jun 28, 2024
Package
Affected versions
< 1.0.22
>= 2.0.0, < 2.0.46
>= 3.0.0, < 3.0.33
Patched versions
1.0.22
2.0.46
3.0.33
Description
Published by the National Vulnerability Database
Jun 27, 2024
Published to the GitHub Advisory Database
Jun 28, 2024
Reviewed
Jun 28, 2024
Last updated
Jun 28, 2024
In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.
References