subjectsplus / SubjectsPlus

Repository for the SubjectsPlus project. This is version 4.6 (July 2021); for version 3, select branch > versionthree; for version 2, select branch > versiontwo.
http://subjectsplus.github.io/
Other
45 stars 31 forks source link

refactor: upgrade phpseclib to 2.0.47 to fix dependabot alert #1557

Open cgb37 opened 8 months ago

cgb37 commented 8 months ago

https://github.com/subjectsplus/SubjectsPlus/security/dependabot/10

Upgrade phpseclib/phpseclib to fix [2 Dependabot alerts]

"require": { "phpseclib/phpseclib": "2.0.47" }

phpseclib/phpseclib >= 2.0.0, < 2.0.47 An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).