web-token/jwt-framework

Release Notes for 4.1.7

Security patch release (4.1.x).

Brings the security fixes up from 4.0.x (#655):

• PBES2-HS*+A*KW — bounded p2c (PBKDF2 iteration count) to prevent a CPU-amplification denial of service. (GHSA-3prj-6hqw-cm82)
• ChaCha20-Poly1305 key encryption — Poly1305 authentication tag now emitted and verified. (GHSA-6vvh-pxr4-25r7)
• RSA1_5 — constant-time implicit rejection (Bleichenbacher mitigation). (GHSA-5739-39v2-5754)
• JWS — alg read only from the integrity-protected header (algorithm-confusion mitigation). (GHSA-jc38-x7x8-2xc8)

Release Notes for 4.1.6

4.1.x bugfix release (patch)

• Fix brick/math version in the library

4.1.6

• Total issues resolved: 1
• Total pull requests resolved: 0
• Total contributors: 0

Release Notes for 4.1.5

4.1.x bugfix release (patch)

4.1.5

• Total issues resolved: 0
• Total pull requests resolved: 0
• Total contributors: 0

Release Notes for 4.1.4

4.1.x bugfix release (patch)

4.1.4

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

Dependencies

• 649: Update brick/math constraint and remove dev minimum stability thanks to @Spomky

Release Notes for 4.1.3

4.1.x bugfix release (patch)

4.1.3

• Total issues resolved: 0

• Total pull requests resolved: 1

• Total contributors: 1

• 648: Fix PHP 8.5 deprecation thanks to @sandesh-as

Release Notes for 4.1.2

4.1.x bugfix release (patch)

4.1.2

• Total issues resolved: 0
• Total pull requests resolved: 0
• Total contributors: 0

Release Notes for 4.1.1

4.1.x bugfix release (patch)

4.1.1

• Total issues resolved: 1
• Total pull requests resolved: 2
• Total contributors: 2

bug

• 645: Refactor command help text definitions for Symfony Console compatibility thanks to @Spomky and @LumiSys

• 643: Update CI configuration to trigger on all version branches thanks to @Spomky

Release Notes for 4.0.7

Security patch release (4.0.x).

Brings the security fixes up from 3.4.x (#652):

• PBES2-HS*+A*KW — bounded p2c (PBKDF2 iteration count) to prevent a CPU-amplification denial of service. (GHSA-3prj-6hqw-cm82)
• ChaCha20-Poly1305 key encryption — Poly1305 authentication tag now emitted and verified. (GHSA-6vvh-pxr4-25r7)
• RSA1_5 — constant-time implicit rejection (Bleichenbacher mitigation). (GHSA-5739-39v2-5754)
• JWS — alg read only from the integrity-protected header (algorithm-confusion mitigation). (GHSA-jc38-x7x8-2xc8)

Also included:

• #641 Enhance key operations validation in UsageAnalyzer and add unit tests thanks to @Spomky

Release Notes for 3.4.10

Security patch release.

This release addresses four security issues in the JOSE implementation:

• PBES2-HS*+A*KW — the p2c (PBKDF2 iteration count) is now bounded (configurable) to prevent a CPU-amplification denial of service. (GHSA-3prj-6hqw-cm82)
• ChaCha20-Poly1305 key encryption — the Poly1305 authentication tag is now emitted and verified; tampered tokens are rejected. (GHSA-6vvh-pxr4-25r7)
• RSA1_5 — PKCS#1 v1.5 decryption now uses constant-time implicit rejection, mitigating Bleichenbacher-style padding oracles. (GHSA-5739-39v2-5754)
• JWS — the alg parameter is read only from the integrity-protected header, preventing algorithm-confusion attacks. (GHSA-jc38-x7x8-2xc8)

Note: 3.4.10 ships the fixes; the accompanying test-suite update is included in 3.4.11.

Release Notes for 3.4.9

3.4.x bugfix release (patch)

3.4.9

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

enhancement

• 644: Add sodium support for Base64 URL safe encoding/decoding thanks to @jdreesen