Skip to content

[GHSA-f9x3-7vq9-cph6] Add patched Laravel 10.x and 11.x versions - #10855

Open
rmcdaniel wants to merge 1 commit into
github:rmcdaniel/advisory-improvement-10855from
rmcdaniel:rmcdaniel/GHSA-f9x3-7vq9-cph6
Open

rmcdaniel wants to merge 1 commit into
github:rmcdaniel/advisory-improvement-10855from
rmcdaniel:rmcdaniel/GHSA-f9x3-7vq9-cph6

Conversation

@rmcdaniel

Copy link
Copy Markdown

Add patched versions for Laravel 10.x and 11.x

GHSA-f9x3-7vq9-cph6 currently treats every laravel/framework release below 12.68.0 as affected. Laravel has released the same fix on two additional release lines:

  • 10.x: v10.50.4 includes 47781ee0cc09940c2d706623160e14d7c6eb6b36, "Reject non-string tokens in TokenGuard (#62177)". Its commit message identifies it as the 10.x backport of this GHSA, mirroring 8dbb08bccac1be095dba4a9d259a419620f1e8a5.
  • 11.x: v11.56.1 includes 5056ca53797eed9244749695c3bb3f015a38415c, which adds the same two is_string checks to TokenGuard::user() and TokenGuard::validate(), with tests.

This splits the <12.68.0 range into <10.50.4, >=11.0.0 <11.56.1 and >=12.0.0 <12.68.0. The 13.x range is unchanged. Laravel 9.x has no fixed release and stays affected.

Supporting references (added as WEB references):

Each fix commit is contained in its patched tag and not in the preceding tag (v10.50.3, v11.56.0).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant