CVE-2023-52892 Name confusion in x509 Subject Alternative Name fields
Attackers can bypass TLS certificate host verification by exploiting regex injection in Subject Alternative Name fields, allowing man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52892?
CVE-2023-52892 is a high-severity vulnerability in n/a, published on 27 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificates are incorrectly allowed to have a special meaning in regular expressions (such as a + wildcard), leading to name confusion in X.509 certificate host verification.
Weakness: CWE-436
Which versions are affected by CVE-2023-52892?
6 open source packages ship an affected version, including phpseclib/phpseclib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpseclib/phpseclib Packagist | All versions | 1.0.22 |
phpseclib/phpseclib Packagist | All versions | 1.0.22 |
phpseclib/phpseclib Packagist | From 2.0.0 | 2.0.46 |
phpseclib/phpseclib Packagist | From 2.0.0 | 2.0.46 |
phpseclib/phpseclib Packagist | From 3.0.0 | 3.0.33 |
phpseclib/phpseclib Packagist | From 3.0.0 | 3.0.33 |
Products include Phpseclib Phpseclib.
How do I fix CVE-2023-52892?
Upgrade phpseclib/phpseclib to a fixed version for your release line: 1.0.22, 2.0.46 or 3.0.33.
Is CVE-2023-52892 being exploited?
There is no known exploitation of CVE-2023-52892 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-32935 phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
- CVE-2023-49316 Phpseclib needs guardrails on large binaryfield integers
- CVE-2023-27560 phpseclib Infinite Loop vulnerability
- CVE-2026-55599 phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
- CVE-2026-40194 phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
Sources
Also known as DEBIAN-CVE-2023-52892, GHSA-ff7q-6vwh-v9m4, UBUNTU-CVE-2023-52892.