-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 09 Nov 2026 10:13:05 +0100
Source: php-web-token-jwt-framework
Architecture: source
Version: 4.2.7-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Changes:
php-web-token-jwt-framework (4.2.7-1) unstable; urgency=medium
.
[ Florent Morselli ]
* Parse the signatures of a JSON general JWS in linear time
(GHSA-jgv7-g4jg-6hqv)
* Bound the JSON values a token may hold before decoding it
(GHSA-2xq2-pp89-x7fr)
* Blind the RSA private key operations (GHSA-2qpx-pwmq-r27r)
* Reject RSA representatives equal to the modulus (GHSA-2qpx-pwmq-r27r)
* Refuse a direct encryption key shorter than the CEK (GHSA-jc6j-46g2-xwqc)
* Require an empty encrypted key with dir, ECDH-ES and ECDH-SS
(GHSA-5cc5-v8qv-6cw7)
* Bound RSA keys to the limits of OpenSSL before computing with them
(GHSA-96f8-m4jr-72xj)
* Keep the keys out of the exception traces of a rejected JWE
(GHSA-7hp7-mg7x-hww4)
* Keep the decrypted content of a nested token out of the exception traces
(GHSA-7hp7-mg7x-hww4)
* Make the OpenSSL refusal of an ECDH public key final (GHSA-wwq7-mh3q-hwrh)
* Share the PBES2 iteration count cap between the recipients of a token
(GHSA-3vqw-452c-g726)
* Let the loaders bound the number of recipients and signatures
(GHSA-3vqw-452c-g726)
* Decrypt exactly one RSA-OAEP block of the modulus length
(GHSA-wwcr-82mc-w3pw)
* Refuse AES key wrapping keys shorter than the algorithm key size
(GHSA-4mxj-75j2-j8hc)
* fix(core): repair the conditional swap of the elliptic curve points
* fix(checker): accept a value only when the callable returns true
* Keep an x5u entry from naming a local file
* fix: refuse header checkers that a loader factory cannot apply
* fix(key-mgmt): include the request headers in the key of the JKU/X5U cache
* Compute ECDH-SS from the two static keys only
* fix(core): reject the bytes outside the alphabet on the sodium path
* fix(bundle): stop merging the alias lists of a service by position
* fix(key-mgmt): keep the JKU/X5U requests whose headers cannot be serialized
* fix(bundle): keep the key attribute of the alias lists
.
[ David Prévot ]
* Update copyright (email address)
* Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
Repository-Browse, Security-Contact
Checksums-Sha1:
3673efc27e9cb1d78fa8413eaedfcaf0500752c4 2418 php-web-token-jwt-framework_4.2.7-1.dsc
4953e481c96331548c6c0b0114b772ea93bcccb1 370516 php-web-token-jwt-framework_4.2.7.orig.tar.xz
ec04d50be8188f4886372489997abcc73976a72c 5944 php-web-token-jwt-framework_4.2.7-1.debian.tar.xz
d8ddf89742a5e263cddeda50217ae6d9275f4473 8737 php-web-token-jwt-framework_4.2.7-1_amd64.buildinfo
Checksums-Sha256:
44e8a5efb2c453f09821f2e3bcda66246719a78449d398e8175ae78e36e2c06d 2418 php-web-token-jwt-framework_4.2.7-1.dsc
a5cc48774ef8bb18ab89c14fe0edb9080990e37ab348bd55b7c6efe247e0c61f 370516 php-web-token-jwt-framework_4.2.7.orig.tar.xz
74d4f633af9cfcfc8d86a6bd1d9b77c5bb952396801abb9898204a06b90daae2 5944 php-web-token-jwt-framework_4.2.7-1.debian.tar.xz
b28d261efa5fd8db6c3e5c63ee1d3a5ea9a8fbb765f54f73caf0ea2e2333bf66 8737 php-web-token-jwt-framework_4.2.7-1_amd64.buildinfo
Files:
8a0c97d709604bdec81e416da273f645 2418 php optional php-web-token-jwt-framework_4.2.7-1.dsc
e848d9bf2f4eb550df8a5da73922fb19 370516 php optional php-web-token-jwt-framework_4.2.7.orig.tar.xz
d4b195bf41473f8e79321c0da78cdc3b 5944 php optional php-web-token-jwt-framework_4.2.7-1.debian.tar.xz
314cd45c3c718b28e8afd2657e0e8446 8737 php optional php-web-token-jwt-framework_4.2.7-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQFGBAEBCgAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmrxlJoSHHRhZmZpdEBk
ZWJpYW4ub3JnAAoJEAWMHPlE9r08O2EH/0a1F514DYzXyPB81m5fPSNSB3W1o+dI
/BQOWfQLJXpV/YaAPCmpRn3usHqKn1ikyK/e6INt2vsIrbradw2JWMNkVb+W26HK
kWxSdvQXXGMmRgo/rjXunqZJnvKJpcNXB9fPP4yCpb4Yl1g9GXf1VwgGFBHc/f17
DBER7EGjoUMQ0+HvtoYNxqos0SYwDVlS/BRBAux43SbMiCAsTQELhXpjgLSJdP7v
HisR3GckNoo1sbR1vD8BXXKZkxW7eYZBqkaOJNnVqpxFtBcbTh3WMnn7WsWrLnQu
xwyOoyvlGZZuKAd0EEWTWFHgAs39+mYoUnaBQYLGx5YxSuNkaa0Xego=
=Q1GR
-----END PGP SIGNATURE-----
