CVE-2023-27560: 
PHP vulnerability analysis and mitigation

A vulnerability was discovered in phpseclib 3.x before version 3.0.19, specifically in the Math/PrimeField.php component. The vulnerability was assigned CVE-2023-27560 and was disclosed on March 3, 2023. The issue involves an infinite loop condition that occurs when dealing with composite primefields (CVE Mitre, GitHub Release).

The vulnerability exists in the PrimeField.php component where the primality check for the modulo parameter was commented out, allowing composite numbers to be processed as prime numbers. This led to an infinite loop condition in the affected versions. The issue was introduced in version 3.0.0 and was fixed in version 3.0.19 by re-implementing proper prime number validation (Debian Tracker, GitHub Commit).

The vulnerability could lead to denial of service conditions due to infinite loops when processing composite primefields. Notably, this vulnerability later led to another security issue (CVE-2024-27354) during its attempted fix (NVD).

The vulnerability was fixed in phpseclib version 3.0.19. The fix involves re-enabling the prime number validation check in the PrimeField constructor, which prevents composite numbers from being processed as prime numbers. Users are advised to upgrade to version 3.0.19 or later (GitHub Release).