Clarify importance of phpseclib security release

[lode]

One of the dependencies, phpseclib, just released https://github.com/phpseclib/phpseclib/releases/tag/3.0.7 which was flagged as a security release. Since I don't have enough knowledge about reviewing their changes, it would be nice if you could provide some more information on this.

E.g. how is this used? What cases does this fix? How high risk is it for this project?
And maybe adjust the dependency in composer to minimally 2.0.31/3.0.7 to confirm this is a needed/safe upgrade?

[bshaffer]

Hello @lode ! Sorry to answer this so late, but this is a great question.

PHPSeclib is only used in this library when verifying ID tokens using the Google\AccessToken\Verify class or calling the Google\Client::verifyIdToken method.

We require a minimum of 3.0.2, and as far as I can tell, this version is considered safe. If I'm wrong, I'm happy to bump the minimum version. You can submit a PR to do so, or reopen this issue and tell me where I can see that the 3.0.7 release was flagged as a security release (I can't see anything in the URL you provided).

I hope this helps. Thanks!

[lode]

Hi @bshaffer thanks for the reply!

And I'm sorry for the unclear link. It was a while ago now, and I don't remember the issue. I'm also a bit puzzled why I linked to 3.0.7, because indeed nothing is shown there. And in my internal issue tracking I see a mention of another version (to which I patched at that moment): https://github.com/phpseclib/phpseclib/releases/tag/3.0.19. I was notified by GitHub via GHSA-hm7p-r324-hhf3.

So I'd say this repo is still using a vulnerable dependency. But I don't know if that part is used and thus needed?

[bshaffer]

This is super helpful, thank you @lode !

As mentioned above, phpseclib is used in this library ONLY to verify ID tokens in Google\Client::verifyIdToken (or directly with the Google\AccessToken\Verify class).

I've submitted a fix to raise the minimum version here: #2499

Thanks again for providing this information!

[lode]

Great, thanks for the fix!