Packagist/web-token/jwt-library: medium
PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle
Action: Upgrade web-token/jwt-library to 3.4.10 or later.
composer require web-token/jwt-library:3.4.10composer require web-token/jwt-library:4.0.7composer require web-token/jwt-library:4.1.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.4.10 | - |
| 4.0.0 | 4.0.7 | - |
| 4.1.0 | 4.1.7 | - |
Fixed versions
| 3.4.10 | 4.0.7 | 4.1.7 |
Sources
- osv: GHSA-5739-39v2-5754
- https://github.com/web-token/jwt-framework/security/advisories/GHSA-5739-39v2-5754
- https://github.com/FriendsOfPHP/security-advisories/blob/master/web-token/jwt-library/GHSA-5739-39v2-5754.yaml
- https://github.com/web-token/jwt-framework
published · modified · JSON