-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpseclib/phpseclib | composer | < 1.0.22 | 1.0.22 |
| phpseclib/phpseclib | composer | >= 2.0.0, < 2.0.46 | 2.0.46 |
| phpseclib/phpseclib | composer | >= 3.0.0, < 3.0.33 | 3.0.33 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from improper sanitization of SAN values in certificate validation. The commit diff shows the vulnerable code used str_replace(array('.', ''), array('.', '[^.]'), $value) which only handled two characters. The patched version introduced preg_quote() to escape all regex special characters first, then specifically handled the wildcard. The validateURL function is directly responsible for hostname verification and contained the insecure regex pattern matching logic. Test cases in X509Test.php demonstrate how special characters like '+' could bypass validation before the fix.