Packagist/web-token/jwt-bundle: high
PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks
Action: Upgrade web-token/jwt-bundle to 3.4.10 or later.
composer require web-token/jwt-bundle:3.4.10composer require web-token/jwt-bundle:4.0.7composer require web-token/jwt-bundle:4.1.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.4.10 | - |
| 4.0.0 | 4.0.7 | - |
| 4.1.0 | 4.1.7 | - |
Fixed versions
| 3.4.10 | 4.0.7 | 4.1.7 |
Sources
- osv: GHSA-jc38-x7x8-2xc8#Packagist/web-token/jwt-bundle
- https://github.com/web-token/jwt-framework/security/advisories/GHSA-jc38-x7x8-2xc8
- https://github.com/FriendsOfPHP/security-advisories/blob/master/web-token/jwt-library/GHSA-jc38-x7x8-2xc8.yaml
- https://github.com/web-token/jwt-framework
published · modified · JSON