Page MenuHomePhabricator

php-jwt contains weak encryption
Closed, ResolvedPublic

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
mediawiki/extensions/ContentTranslationwmf/1.46.0-wmf.15+1 -1
mediawiki/extensions/ContentTranslationwmf/1.46.0-wmf.16+1 -1
mediawiki/extensions/CheckUserwmf/1.46.0-wmf.16+1 -1
mediawiki/extensions/CheckUserwmf/1.46.0-wmf.15+1 -1
mediawiki/extensions/OAuthwmf/1.46.0-wmf.15+1 -1
mediawiki/extensions/OAuthwmf/1.46.0-wmf.16+1 -1
mediawiki/vendorwmf/1.46.0-wmf.15+157 -41
mediawiki/vendorwmf/1.46.0-wmf.16+157 -41
mediawiki/extensions/CheckUserREL1_45+2 -2
mediawiki/extensions/CheckUserREL1_44+2 -2
mediawiki/extensions/ContentTranslationREL1_43+1 -1
mediawiki/extensions/CheckUserREL1_43+1 -1
mediawiki/extensions/ContentTranslationREL1_45+1 -1
mediawiki/extensions/ContentTranslationREL1_44+1 -1
mediawiki/extensions/ContentTranslationmaster+1 -1
mediawiki/extensions/CheckUsermaster+1 -1
mediawiki/extensions/OAuthREL1_45+1 -1
mediawiki/extensions/OAuthREL1_43+1 -1
mediawiki/extensions/OAuthREL1_44+1 -1
mediawiki/extensions/OAuthmaster+1 -1
mediawiki/vendorREL1_44+239 -86
mediawiki/vendorREL1_45+157 -41
mediawiki/vendormaster+157 -41
Show related patches Customize query in gerrit

Event Timeline

Change #1240093 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240093

Change #1240094 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OAuth@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240094

Change #1240096 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/CheckUser@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240096

Change #1240097 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/ContentTranslation@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240097

Reedy triaged this task as High priority.Wed, Feb 18, 1:44 AM

Change #1240093 merged by jenkins-bot:

[mediawiki/vendor@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240093

Change #1240094 merged by jenkins-bot:

[mediawiki/extensions/OAuth@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240094

Change #1240100 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@REL1_45] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)

https://gerrit.wikimedia.org/r/1240100

Change #1240101 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@REL1_44] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)

https://gerrit.wikimedia.org/r/1240101

Change #1240100 merged by Reedy:

[mediawiki/vendor@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240100

Change #1240101 merged by Reedy:

[mediawiki/vendor@REL1_44] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)

https://gerrit.wikimedia.org/r/1240101

Change #1240102 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OAuth@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240102

Change #1240103 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OAuth@REL1_44] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240103

Change #1240104 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OAuth@REL1_43] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240104

Change #1240103 merged by jenkins-bot:

[mediawiki/extensions/OAuth@REL1_44] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240103

Change #1240104 merged by jenkins-bot:

[mediawiki/extensions/OAuth@REL1_43] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240104

Change #1240102 merged by jenkins-bot:

[mediawiki/extensions/OAuth@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240102

Change #1240096 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240096

Change #1240109 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/CheckUser@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240109

Change #1240110 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/CheckUser@REL1_44] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240110

Change #1240112 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/CheckUser@REL1_43] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)

https://gerrit.wikimedia.org/r/1240112

Change #1240097 merged by jenkins-bot:

[mediawiki/extensions/ContentTranslation@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240097

Change #1240115 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/ContentTranslation@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240115

Change #1240116 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/ContentTranslation@REL1_44] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240116

Change #1240117 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/ContentTranslation@REL1_43] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240117

Change #1240116 merged by jenkins-bot:

[mediawiki/extensions/ContentTranslation@REL1_44] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240116

Change #1240115 merged by jenkins-bot:

[mediawiki/extensions/ContentTranslation@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240115

Change #1240112 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@REL1_43] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)

https://gerrit.wikimedia.org/r/1240112

Change #1240117 merged by jenkins-bot:

[mediawiki/extensions/ContentTranslation@REL1_43] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240117

Purely out of interest, did this trigger Composer's automatic-security-blocking in CI at any point? (I had a quick look to try and find a failed build from it, but I couldn't immediately see one.)

Also, this might be a stupid question… but as a side note: from the CVE record, it seems like this CVE was published in July 2025 — how come we (IIUC) only seem to be finding out about it now?
(To - potentially - answer my own question, maybe it might be because it seems like it may have only been published as a GitHub security advisory within the last day? I can't say I'm certain on that, though.)

(Also, just FWIW & so that we have a downstream note of it, the CVE record is marked as being disputed "on the basis that key lengths are expected to be set by an application, not by this library".)

Purely out of interest, did this trigger Composer's automatic-security-blocking in CI at any point?

Answering my own question -- yes, it has (e.g. https://integration.wikimedia.org/ci/job/quibble-composer-mysql-php83/14643/console for https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/1240272)

13:03:25 INFO:quibble.commands:>>> Start: composer test in /workspace/src/extensions/CheckUser
13:03:26 ./composer.json is valid, but with a few warnings
13:03:26 See https://getcomposer.org/doc/04-schema.md for details on the schema
13:03:26 # General warnings
13:03:26 - No license specified, it is recommended to do so. For closed-source software you may use "proprietary" as license.
13:03:26 [12.5MiB/0.10s] No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
13:03:26 [12.6MiB/0.10s] Loading composer repositories with package information
13:03:26 [16.6MiB/0.61s] Updating dependencies
13:03:26 [17.8MiB/0.62s] Dependency resolution completed in 0.002 seconds
13:03:26 [17.8MiB/0.62s] Your requirements could not be resolved to an installable set of packages.
13:03:26 [17.8MiB/0.62s] 
13:03:26   Problem 1
13:03:26     - Root composer.json requires firebase/php-jwt ^6.10.0, found firebase/php-jwt[v6.10.0, v6.10.1, v6.10.2, v6.11.0, v6.11.1] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-y2cr-5h3j-g3ys") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

Change #1240110 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@REL1_44] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)

https://gerrit.wikimedia.org/r/1240110

Change #1240109 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240109

Purely out of interest, did this trigger Composer's automatic-security-blocking in CI at any point?

Answering my own question -- yes, it has (e.g. https://integration.wikimedia.org/ci/job/quibble-composer-mysql-php83/14643/console for https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/1240272)

Also blocking a deploy in this job for this backport. :|

Change #1240340 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240340

Change #1240343 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240343

Change #1240340 merged by jenkins-bot:

[mediawiki/vendor@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240340

Change #1240345 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/CheckUser@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240345

Change #1240346 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/CheckUser@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240346

Change #1240347 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240347

Change #1240348 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240348

Change #1240349 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/ContentTranslation@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240349

Change #1240350 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/ContentTranslation@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240350

Change #1240343 merged by jenkins-bot:

[mediawiki/vendor@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240343

Change #1240345 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240345

Change #1240346 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240346

Change #1240347 merged by jenkins-bot:

[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240347

Change #1240348 merged by jenkins-bot:

[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240348

Change #1240349 merged by jenkins-bot:

[mediawiki/extensions/ContentTranslation@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240349

Change #1240350 merged by jenkins-bot:

[mediawiki/extensions/ContentTranslation@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)

https://gerrit.wikimedia.org/r/1240350

Mentioned in SAL (#wikimedia-operations) [2026-02-18T17:58:00Z] <reedy@deploy2002> Started scap sync-world: Backport for [[gerrit:1240340|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240343|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240345|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240346|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240347|Upgrading firebase/php-jwt (v6.11.1 => v

Mentioned in SAL (#wikimedia-operations) [2026-02-18T18:00:22Z] <reedy@deploy2002> reedy: Backport for [[gerrit:1240340|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240343|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240345|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240346|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240347|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]]

Mentioned in SAL (#wikimedia-operations) [2026-02-18T18:04:59Z] <reedy@deploy2002> Finished scap sync-world: Backport for [[gerrit:1240340|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240343|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240345|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240346|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240347|Upgrading firebase/php-jwt (v6.11.1 =>

Reedy claimed this task.