{"id":"GHSA-vf4w-fg7r-5v94","summary":"Improper Certificate Validation in phpseclib","details":"phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.","aliases":["CVE-2021-30130"],"modified":"2026-08-24T00:34:02.894576282Z","published":"2021-04-07T20:56:55Z","database_specific":{"nvd_published_at":"2021-04-06T15:15:00Z","cwe_ids":["CWE-295","CWE-347"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-04-07T17:29:49Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30130"},{"type":"WEB","url":"https://github.com/phpseclib/phpseclib/pull/1635"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2021-30130.yaml"},{"type":"WEB","url":"https://github.com/phpseclib/phpseclib/releases/tag/2.0.31"},{"type":"WEB","url":"https://github.com/phpseclib/phpseclib/releases/tag/3.0.7"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00024.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00025.html"}],"affected":[{"package":{"name":"phpseclib/phpseclib","ecosystem":"Packagist","purl":"pkg:composer/phpseclib/phpseclib"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.7"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-vf4w-fg7r-5v94/GHSA-vf4w-fg7r-5v94.json"}},{"package":{"name":"phpseclib/phpseclib","ecosystem":"Packagist","purl":"pkg:composer/phpseclib/phpseclib"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.31"}]}],"versions":["0.3.0","0.3.1","0.3.10","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","1.0.3","1.0.30","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.20","2.0.21","2.0.22","2.0.23","2.0.24","2.0.25","2.0.26","2.0.27","2.0.28","2.0.29","2.0.3","2.0.30","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-vf4w-fg7r-5v94/GHSA-vf4w-fg7r-5v94.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}