[GHSA-3prj-6hqw-cm82] PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service

[magnogaspar]

Updates

• Affected products

Comments
The web-token/jwt-framework entry listed <= 4.1.6 as affected with no patched version, while the web-token/jwt-library entries in this same advisory correctly list 3.4.10, 4.0.7 and 4.1.7 as patched.

web-token/jwt-framework is the pre-split package (and, in 4.x, a meta-package that pins the corresponding web-token/jwt-library version), so the same version ranges and patched versions apply to both package names.

I verified the fix is present in jwt-framework 3.4.10 by diffing src/Library/Encryption/Algorithm/KeyEncryption/PBES2AESKW.php between tags 3.4.9 and 3.4.10: 3.4.10 introduces DEFAULT_MAX_COUNT = 1_000_000 and enforces it in checkHeaderAdditionalParameters(), which is the mitigation described in this advisory (unbounded p2c PBKDF2 iteration count).

This change mirrors the existing web-token/jwt-library ranges onto web-token/jwt-framework:

• < 3.4.10 → patched 3.4.10
• >= 4.0.0, < 4.0.7 → patched 4.0.7
• >= 4.1.0, < 4.1.7 → patched 4.1.7

Impact of the current metadata: the open-ended <= 4.1.6 range with no patched version causes false positives in Dependabot and dependency-review-action for projects correctly resolved to patched 3.4.x versions — e.g. Magento / Adobe Commerce 2.4.8, which resolves web-token/jwt-framework to 3.4.10 via the ^3.4 constraint from magento/product-enterprise-edition and cannot reach 4.x without a platform upgrade.

[github]

Hi there @Spomky! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[magnogaspar]

Note for reviewers: #8096 (opened earlier by @hostep) addresses the same issue on this advisory. This PR differs in two points: the 4.0.x range here is >= 4.0.0, < 4.0.7 → fixed 4.0.7 (in #8096 it was accidentally set to 4.1.7,
as the author noted in his self-review), and there is no leftover database_specific.last_known_affected_version_range block. The resulting web-token/jwt-framework ranges exactly mirror the web-token/jwt-library entries already present in this advisory.