Back Linuxsecurity

Debian Oldstable phpseclib Key Padding Attack Fix DSA-6185-1 CVE-2026

Linuxsecurity •LinuxSecurity Advisories • March 29, 2026

For the oldstable distribution (bookworm), these problems have been fixed in version 1.0.20-1+deb12u3. This update also fixes CVE-2023-52892. For the stable distribution (trixie), these problems have been fixed in version 1.0.23-6+deb13u1. We recommend that you upgrade your phpseclib packages. For the detailed security status of phpseclib please refer to its security tracker page at: Further information Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Debian Security Updates Address phpseclib Vulnerabilities Debian has released security updates for the phpseclib library across its oldstable and stable distributions. The updates address vulnerabilities identified as CVE-2023-52892, which affects multiple versions of phpseclib, including php-phpseclib3, php-phpseclib, and phpseclib. For the oldstable distribution (bookworm), the affected versions have been updated to 3.0.19-1+deb12u4, 2.0.42-1+deb12u3, and 1.0.20-1+deb12u3 respectively. The stable distribution (trixie) has received updates to versions 3.0.43-2+deb13u1, 2.0.48-3+deb13u1, and 1.0.23-6+deb13u1. Users are advised to upgrade their phpseclib packages to mitigate potential security risks. The vulnerabilities could expose systems to unauthorized access or data breaches if left unpatched. The updates were published on March 29, 2026, and are crucial for maintaining system integrity. 3 sources 46

Extracted Entities

CVEs (1)

CVE-2023-52892