Package conflicts with roave/security-advisories

[SunMar]

Hi,

In Roave/SecurityAdvisories@91fab0d#diff-d2ab9925cad7eac58e0ff4cc0d251a937ecf49e4b6bf57f8b95aab76648a9d34R323 the roave/security-advisories package marked versions of phpseclib lower than 2.0.41 as a conflict. Because the compatibility package identifies itself as providing version 2.0.33, it now is in conflict and composer fails installing.

Solved this for us by removing the dependency on this package (we already refactored most usages to directly depend on 3.0 a while ago).

[terrafrost]

roave/security-advisories is wrong, plain and simple. I created a PR against them here:

Roave/SecurityAdvisories#108

The CVE that they used to create the security advisory is demonstratably wrong, as well, as detailed in my PR. I mean, the underlying issue exists but not in the versions of the CVE mentions.

I mean, I'll make a gratuitous fluff release of both phpseclib2_compat and phpseclib 2.0 if I absolutely must but it is a little disconcerting... could somebody DoS the entire PHP ecosystem by creating a bogus CVE?

I didn't create the CVE. idk how to create CVEs. But I'm contact with the people that did to try to get the issue resolved in the CVE as well, if it's even possible.

[terrafrost]

I just went ahead and released a new version. Altho the motivations behind the release are completely without merit for phpseclib 2.0 it doesn't change the fact that this situation is liable to cause disruption as it did for you