Page MenuHomePhabricator

CVE-2021-46743: firebase/php-jwt Key/algorithm type confusion
Closed, ResolvedPublicSecurity

Description

Found 1 security vulnerability advisory affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package           | firebase/php-jwt                                                                 |
| CVE               | CVE-2021-46743                                                                   |
| Title             | Key/algorithm type confusion                                                     |
| URL               | https://github.com/advisories/GHSA-8xf4-w7qw-pjjw                                |
| Affected versions | <6.0.0                                                                           |
| Reported at       | 2022-03-30T00:00:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46743

Need to upgrade >= 6.0.0

Event Timeline

Change 911302 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@master] Upgrading firebase/php-jwt (v5.5.1 => v6.4.0)

https://gerrit.wikimedia.org/r/911302

Change 911302 merged by jenkins-bot:

[mediawiki/vendor@master] Upgrading firebase/php-jwt (v5.5.1 => v6.4.0)

https://gerrit.wikimedia.org/r/911302

sbassett changed the task status from Open to In Progress.May 2 2023, 4:49 PM
sbassett triaged this task as Medium priority.
sbassett moved this task from Incoming to In Progress on the Security-Team board.
Reedy claimed this task.
Reedy changed the visibility from "Custom Policy" to "Public (No Login Required)".
Reedy changed the edit policy from "Custom Policy" to "All Users".