Packagist/web-token/jwt-library: medium
PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption
Action: Upgrade web-token/jwt-library to 3.4.10 or later.
composer require web-token/jwt-library:3.4.10composer require web-token/jwt-library:4.0.7composer require web-token/jwt-library:4.1.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.4.10 | - |
| 4.0.0 | 4.0.7 | - |
| 4.1.0 | 4.1.7 | - |
Fixed versions
| 3.4.10 | 4.0.7 | 4.1.7 |
Sources
- osv: GHSA-6vvh-pxr4-25r7#Packagist/web-token/jwt-library
- https://github.com/web-token/jwt-framework/security/advisories/GHSA-6vvh-pxr4-25r7
- https://github.com/FriendsOfPHP/security-advisories/blob/master/web-token/jwt-library/GHSA-6vvh-pxr4-25r7.yaml
- https://github.com/web-token/jwt-framework
published · modified · JSON