Skip to content

refactor: Switch to packbackbooks/lti-1-3-php-library #1556

@cgb37

Description

@cgb37

Due to the possible abandonment of the original lti-1-3-php-library and need to address vulnerability issues with phpseclib version 2, SP is going to switch to a forked version.

Here is the issue:
1EdTech/lti-1-3-php-library#75

and Dependabot:
phpseclib does not properly limit the ASN1 OID length #10
https://github.com/subjectsplus/SubjectsPlus/security/dependabot/10
An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for decodeOID).

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions