Xmlseclibs Laravel Package

xmlseclibs 4.0.0-beta2

PHP 8.0+ and phpseclib/phpseclib ~3.0 required; OpenSSL is optional. This is a beta — APIs and defaults may still change before 4.0.0 final.

Highlights

• Crypto moved to phpseclib (symmetric, RSA, RSA-OAEP, X.509); RSA-PSS (RSA_SHA256_MGF1) supported
• Safe-by-default verifyDocument() — pinned key, algorithm allowlists, validated node set
• enableLegacyMode() for temporary pre-4.0 interop while migrating peers
• Compact templates via stripWhitespace; omit_uri for references without a URI; extensibility via protected members (#152)

Security (breaking defaults)

• DOCTYPE rejected on signature verify (entity-ref / Id bypass; same class of issue as CVE-2025-23369); also rejected in decrypted XML
• XPath Filtering Transforms rejected on verify by default (pre-auth DoS); capped when enabled
• RSA-1.5 key transport denied on decrypt by default; uniform decrypt errors (no padding oracle)
• verify() always binds SignatureMethod to the supplied key; HMAC cannot be loaded from certs/PEM
• References fail closed (unknown transforms, external/duplicate-Id URIs, unknown C14N)
• SSRF hardening on add509Cert() URL fetch; EncryptedKey/RetrievalMethod depth caps; hash_equals for digests/HMAC

Other

• Configurable transforms element; setSignatureId(); clearer throws when signature context is missing
• Interop: whitespace-stripped signature/EncryptedData templates for C# SignedXml / Python signxml-style peers
• PHP 8 / static-analysis hardening; PHP 8.5 deprecation fix in makeAsnSegment()

Migration

Prefer verifyDocument() with a pinned key. Use enableLegacyMode() only while updating peers — it restores DOCTYPE-on-verify, XPath transforms, and RSA-1.5; it does not undo algorithm/key binding, uniform decrypt errors, or decrypted-XML DOCTYPE rejection. Prefer RSA-OAEP and AES-GCM for new deployments.

Full detail: CHANGELOG.txt (4.0.0-beta2) and the “Breaking changes (3.1 → 4.0)” section in README.md.

xmlseclibs 4.0.0

PHP 8.0+ and phpseclib/phpseclib ~3.0 required; OpenSSL is optional.

Highlights

• Crypto moved to phpseclib (symmetric, RSA, RSA-OAEP, X.509); RSA-PSS (RSA_SHA256_MGF1) supported
• Safe-by-default verifyDocument() — pinned key, algorithm allowlists, validated node set
• enableLegacyMode() for temporary pre-4.0 interop while migrating peers
• Compact templates via stripWhitespace; omit_uri for references without a URI; extensibility via protected members (#152)

Security (breaking defaults)

• DOCTYPE rejected on signature verify (entity-ref / Id bypass; same class of issue as CVE-2025-23369); also rejected in decrypted XML
• XPath Filtering Transforms rejected on verify by default (pre-auth DoS); capped when enabled
• RSA-1.5 key transport denied on decrypt by default; uniform decrypt errors (no padding oracle)
• verify() always binds SignatureMethod to the supplied key; HMAC cannot be loaded from certs/PEM
• References fail closed (unknown transforms, external/duplicate-Id URIs, unknown C14N)
• SSRF hardening on add509Cert() URL fetch; EncryptedKey/RetrievalMethod depth caps; hash_equals for digests/HMAC

Other

• Configurable transforms element; setSignatureId(); clearer throws when signature context is missing
• Interop: whitespace-stripped signature/EncryptedData templates for C# SignedXml / Python signxml-style peers
• PHP 8 / static-analysis hardening; PHP 8.5 deprecation fix in makeAsnSegment()

Migration

Prefer verifyDocument() with a pinned key. Use enableLegacyMode() only while updating peers — it restores DOCTYPE-on-verify, XPath transforms, and RSA-1.5; it does not undo algorithm/key binding, uniform decrypt errors, or decrypted-XML DOCTYPE rejection. Prefer RSA-OAEP and AES-GCM for new deployments.

Full detail: CHANGELOG.txt (4.0.0) and the “Breaking changes (3.1 → 4.0)” section in README.md.

Full Changelog: https://github.com/robrichards/xmlseclibs/compare/3.1.5...4.0.0

Validate AES-GCM Authentication Tag

fix canonicalization error

Removes BC breaking change

Add tab to list of whitespace values to remove from cert loadKey should check return value for openssl_get_privatekey Switch to GitHub actions Support OAEP (from unreleased 3.1.1)

Add support for AES-GCM encryption Minor improvements and bug fixes

Security Release for CVE-2019-3465

Security release

Backports changes from 3.0 branch. This will be the last supported release from 2.x branch

Add PHP 7.3 support

Mainly security related release. See Changelog for more details