search

CyberSource / cybersource-rest-client-php

PHP client library for the CyberSource REST API
27 stars 65 forks source link

Upgrade firebase/php-jwt v6 #122

Closed jbrissonnet-vp closed 1 year ago

jbrissonnet-vp commented 1 year ago

Should fix https://github.com/CyberSource/cybersource-rest-client-php/issues/119

Upgrading firebase/php-jwt to v6 because v5 is vulnerable https://github.com/advisories/GHSA-8xf4-w7qw-pjjw

Here are the Backwards Compatibility Breaking Changes : https://github.com/firebase/php-jwt/releases/tag/v6.0.0

The cybersource SDK itself isn't vulnerable because you are providing the $alg param when calling JWT::encode(), but it forces the version 5 on the whole project, and that may be a security problem for project depending on your lib.

I didnt manage to run phpunit tests on my local env, do you have any CI configured somewhere ?

mstrom commented 1 year ago

@sachshet @gaubansa could you please merge this PR to fix the vulnerability?

irnelia commented 1 year ago

Is it planned to be merged soon?

unfulvio-godaddy commented 1 year ago

What is blocking this from getting merged?

gaubansa commented 1 year ago

version of "firebase/php-jwt" upgraded to ^6.0.0.