[GHSA-5739-39v2-5754] PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle

[magnogaspar]

Updates

• Affected products

Comments
The web-token/jwt-framework entry listed <= 4.1.6 as affected with no patched version, while the web-token/jwt-library entries in this same advisory correctly list 3.4.10, 4.0.7 and 4.1.7 as patched.

web-token/jwt-framework is the pre-split package (and, in 4.x, a meta-package that pins the corresponding web-token/jwt-library version), so the same version ranges and patched versions apply to both package names. The maintainer's release notes list 3.4.10 as containing the fix for this advisory (implicit-rejection mitigation for RSA1_5 decryption).

This change mirrors the existing web-token/jwt-library ranges onto web-token/jwt-framework:

• < 3.4.10 → patched 3.4.10
• >= 4.0.0, < 4.0.7 → patched 4.0.7
• >= 4.1.0, < 4.1.7 → patched 4.1.7

Same metadata issue as GHSA-3prj-6hqw-cm82, for which I've opened #8629. The open-ended <= 4.1.6 range with no patched version causes false positives in Dependabot and dependency-review-action for projects correctly resolved to patched 3.4.x versions (e.g. Magento / Adobe Commerce 2.4.8, which resolves web-token/jwt-framework to 3.4.10 and cannot reach 4.x without a platform upgrade).

[github]

Hi there @Spomky! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory