CVE-2025-45769
En bref
- Source
- NVD
- EPSS
- EPSS 0.15 % · centile 4 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
Faiblesses (CWE)
- CWE-326 — Force de chiffrement insuffisante
Références
- https://github.com/firebase/php-jwt
- https://github.com/firebase
- https://gist.github.com/ZupeiNie/83756316c4c24fe97a50176a92608db3
- https://github.com/firebase/php-jwt/issues/620
- https://github.com/github/advisory-database/pull/6954
- https://github.com/advisories/GHSA-2x45-7fc3-mxwq
- https://github.com/firebase/php-jwt/releases/tag/v7.0.0
- https://github.com/firebase/php-jwt/pull/613
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Avis
- GHSA-2x45-7fc3-mxwq — php-jwt contains weak encryption
Références européennes
- ENISA EUVD · EUVD-2025-23305
- GCVE · GCVE-0-2025-45769
Configurations affectées (CPE NVD)
cpe:2.3:a:google:firebase_php-jwt:*:*:*:*:*:*:*:*≤ 6.11.0
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |