Packagist/web-token/jwt-framework: high
PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service
Action: Upgrade web-token/jwt-framework to 3.4.10 or later.
composer require web-token/jwt-framework:3.4.10composer require web-token/jwt-framework:4.0.7composer require web-token/jwt-framework:4.1.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.4.10 | - |
| 4.0.0 | 4.0.7 | - |
| 4.1.0 | 4.1.7 | - |
Fixed versions
| 3.4.10 | 4.0.7 | 4.1.7 |
Sources
- osv: GHSA-3prj-6hqw-cm82#Packagist/web-token/jwt-framework
- https://github.com/web-token/jwt-framework/security/advisories/GHSA-3prj-6hqw-cm82
- https://github.com/FriendsOfPHP/security-advisories/blob/master/web-token/jwt-library/GHSA-3prj-6hqw-cm82.yaml
- https://github.com/web-token/jwt-framework
- https://github.com/web-token/jwt-framework/releases/tag/3.4.10
- https://github.com/web-token/jwt-framework/releases/tag/4.0.7
- https://github.com/web-token/jwt-framework/releases/tag/4.1.7
published · modified · JSON