Evidentobscurity

**Name of the Vulnerable Software and Affected Versions** phpseclib versions 0.1.1 through 1.0.29 phpseclib versions 2.0.0 through 2.0.54 phpseclib versions 3.0.0 through 3.0.53 **Description** An insecure default in the library allows an unauthenticated attacker to perform Server-Side Request Forgery (SSRF). When an application validates an untrusted X.509 certificate, the `X509::validateSignature()` function reads a URL from the certificate's Authority Information Access (AIA) extension and establishes a connection to it. Because URL fetching is enabled by default without destination blocking, an attacker can control the host, port, and path of the connection to reach internal hosts and services, such as the loopback address 127.0.0.1 or cloud metadata addresses like 169.254.169.254. **Recommendations** Update to version 1.0.30. Update to version 2.0.55. Update to version 3.0.54.