Name confusion in x509 Subject Alternative Name fields

2024-06-2800:33:31

Google

osv.dev

phpseclib

x509

subject alternative name

tls certificates

regular expressions

name confusion

host verification

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.

CPENameOperatorVersion
phpseclib/phpseclibeq2.0.45
phpseclib/phpseclibeq2.0.16
phpseclib/phpseclibeq2.0.7
phpseclib/phpseclibeq2.0.9
phpseclib/phpseclibeq1.0.18
phpseclib/phpseclibeq1.0.3
phpseclib/phpseclibeq2.0.6
phpseclib/phpseclibeq3.0.15
phpseclib/phpseclibeq2.0.30
phpseclib/phpseclibeq2.0.19

Name	Operator	Version
phpseclib/phpseclib	eq	2.0.45
phpseclib/phpseclib	eq	2.0.16
phpseclib/phpseclib	eq	2.0.7
phpseclib/phpseclib	eq	2.0.9
phpseclib/phpseclib	eq	1.0.18
phpseclib/phpseclib	eq	1.0.3
phpseclib/phpseclib	eq	2.0.6
phpseclib/phpseclib	eq	3.0.15
phpseclib/phpseclib	eq	2.0.30
phpseclib/phpseclib	eq	2.0.19