Control: retitle -1 bookworm-pu: package php-phpseclib3/3.0.19-1+deb12u6 Le Sun, Apr 19, 2026 at 12:48:04PM +0200, David Prévot a écrit : […] > [ This bug report is similar to #1134372 for trixie ] > > I’d like to get CVE-2026-40194 fixed in an upcoming point release.
I’d like to also add an additional CVE-2024-27355 workaround as recently published upstream (just a max length change for an ID). The change is pretty trivial. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable Regards, taffit
diff -Nru php-phpseclib3-3.0.19/debian/changelog php-phpseclib3-3.0.19/debian/changelog --- php-phpseclib3-3.0.19/debian/changelog 2026-04-19 11:29:51.000000000 +0200 +++ php-phpseclib3-3.0.19/debian/changelog 2026-04-28 13:53:52.000000000 +0200 @@ -1,3 +1,10 @@ +php-phpseclib3 (3.0.19-1+deb12u6) bookworm; urgency=medium + + * ASN1: reduce length of supported OIDs from 4096 bytes to 128 bytes + [CVE-2024-27355] + + -- David Prévot <[email protected]> Tue, 28 Apr 2026 13:53:52 +0200 + php-phpseclib3 (3.0.19-1+deb12u5) bookworm; urgency=medium * SSH2: use constant time string comparison in get_binary_packet() diff -Nru php-phpseclib3-3.0.19/debian/patches/0020-Revert-Tests-phpseclib-3.0-updates.patch php-phpseclib3-3.0.19/debian/patches/0020-Revert-Tests-phpseclib-3.0-updates.patch --- php-phpseclib3-3.0.19/debian/patches/0020-Revert-Tests-phpseclib-3.0-updates.patch 1970-01-01 01:00:00.000000000 +0100 +++ php-phpseclib3-3.0.19/debian/patches/0020-Revert-Tests-phpseclib-3.0-updates.patch 2026-04-28 13:53:31.000000000 +0200 @@ -0,0 +1,24 @@ +From: =?utf-8?q?David_Pr=C3=A9vot?= <[email protected]> +Date: Tue, 28 Apr 2026 13:41:13 +0200 +Subject: Revert "Tests: phpseclib 3.0 updates" + +This reverts commit baba459ca1b2619b173805ca3dfedc4e5a88eac6. + +Origin: backport, https://github.com/phpseclib/phpseclib/commit/baba459ca1b2619b173805ca3dfedc4e5a88eac6 +--- + phpseclib/File/ASN1.php | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/phpseclib/File/ASN1.php b/phpseclib/File/ASN1.php +index 26bc0bf..41ee514 100644 +--- a/phpseclib/File/ASN1.php ++++ b/phpseclib/File/ASN1.php +@@ -1151,7 +1151,7 @@ abstract class ASN1 + $len = strlen($content); + // see https://github.com/openjdk/jdk/blob/2deb318c9f047ec5a4b160d66a4b52f93688ec42/src/java.base/share/classes/sun/security/util/ObjectIdentifier.java#L55 + if ($len > 4096) { +- //throw new \RuntimeException("Object identifier size is limited to 4096 bytes ($len bytes present)"); ++ //user_error('Object Identifier size is limited to 4096 bytes'); + return false; + } + diff -Nru php-phpseclib3-3.0.19/debian/patches/0021-ASN1-reduce-length-of-supported-OIDs-from-4096-bytes.patch php-phpseclib3-3.0.19/debian/patches/0021-ASN1-reduce-length-of-supported-OIDs-from-4096-bytes.patch --- php-phpseclib3-3.0.19/debian/patches/0021-ASN1-reduce-length-of-supported-OIDs-from-4096-bytes.patch 1970-01-01 01:00:00.000000000 +0100 +++ php-phpseclib3-3.0.19/debian/patches/0021-ASN1-reduce-length-of-supported-OIDs-from-4096-bytes.patch 2026-04-28 13:53:31.000000000 +0200 @@ -0,0 +1,26 @@ +From: terrafrost <[email protected]> +Date: Mon, 27 Apr 2026 01:00:37 -0500 +Subject: ASN1: reduce length of supported OIDs from 4096 bytes to 128 bytes + +Origin: upstream, https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc +Bug: https://github.com/phpseclib/phpseclib/security/advisories/GHSA-2528-jw5q-ww88 +Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2024-27355 +--- + phpseclib/File/ASN1.php | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/phpseclib/File/ASN1.php b/phpseclib/File/ASN1.php +index 41ee514..225fd9a 100644 +--- a/phpseclib/File/ASN1.php ++++ b/phpseclib/File/ASN1.php +@@ -1150,8 +1150,8 @@ abstract class ASN1 + $pos = 0; + $len = strlen($content); + // see https://github.com/openjdk/jdk/blob/2deb318c9f047ec5a4b160d66a4b52f93688ec42/src/java.base/share/classes/sun/security/util/ObjectIdentifier.java#L55 +- if ($len > 4096) { +- //user_error('Object Identifier size is limited to 4096 bytes'); ++ if ($len > 128) { ++ //user_error('Object Identifier size is limited to 128 bytes'); + return false; + } + diff -Nru php-phpseclib3-3.0.19/debian/patches/series php-phpseclib3-3.0.19/debian/patches/series --- php-phpseclib3-3.0.19/debian/patches/series 2026-04-19 11:29:51.000000000 +0200 +++ php-phpseclib3-3.0.19/debian/patches/series 2026-04-28 13:53:31.000000000 +0200 @@ -17,3 +17,5 @@ 0017-make-unpadding-constant-time.patch 0018-X509-fix-for-weird-characters-in-subjaltname.patch 0019-Merge-branch-2.0-into-3.0.patch +0020-Revert-Tests-phpseclib-3.0-updates.patch +0021-ASN1-reduce-length-of-supported-OIDs-from-4096-bytes.patch
signature.asc
Description: PGP signature
