PT-2021-18620 · Phpseclib+3 · Phpseclib+3

Published 2021-04-06 · Updated 2025-08-18 · CVE-2021-30130

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions phpseclib versions prior to 2.0.31 phpseclib versions 3.x prior to 3.0.7

Description The issue concerns the mishandling of RSA PKCS#1 v1.5 signature verification.

Recommendations For versions prior to 2.0.31, update to version 2.0.31 or later. For versions 3.x prior to 3.0.7, update to version 3.0.7 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Improper Certificate Validation

Weakness Enumeration

CWE-347

CWE-295

Related Identifiers

BDU:2025-10827

CVE-2021-30130

DLA-3197-1

DLA-3198-1

GHSA-VF4W-FG7R-5V94

USN-7404-1

Affected Products

Linuxmint

Red Os

Ubuntu

Phpseclib

References · 26

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/phpseclib/phpseclib/CVE-2021-30130.yaml · Exploit
• https://github.com/phpseclib/phpseclib/pull/1635 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-30130 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-30130 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-30130 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10827 · Security Note
• https://ubuntu.com/security/CVE-2024-27355 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3198-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7404-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vf4w-fg7r-5v94 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-30130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27354 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-30130 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-30130 · Vendor Advisory