{"action":"created","issue":{"url":"https://api.github.com/repos/laravel/framework/issues/23611","repository_url":"https://api.github.com/repos/laravel/framework","labels_url":"https://api.github.com/repos/laravel/framework/issues/23611/labels{/name}","comments_url":"https://api.github.com/repos/laravel/framework/issues/23611/comments","events_url":"https://api.github.com/repos/laravel/framework/issues/23611/events","html_url":"https://github.com/laravel/framework/issues/23611","id":306346809,"number":23611,"title":"Laravel 5.1 uses insecure CSPRNG, new release needed","user":{"login":"hackel","id":583677,"avatar_url":"https://avatars2.githubusercontent.com/u/583677?v=4","gravatar_id":"","url":"https://api.github.com/users/hackel","html_url":"https://github.com/hackel","followers_url":"https://api.github.com/users/hackel/followers","following_url":"https://api.github.com/users/hackel/following{/other_user}","gists_url":"https://api.github.com/users/hackel/gists{/gist_id}","starred_url":"https://api.github.com/users/hackel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hackel/subscriptions","organizations_url":"https://api.github.com/users/hackel/orgs","repos_url":"https://api.github.com/users/hackel/repos","events_url":"https://api.github.com/users/hackel/events{/privacy}","received_events_url":"https://api.github.com/users/hackel/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-03-19T06:30:32Z","updated_at":"2018-05-07T21:14:30Z","closed_at":"2018-04-04T15:50:15Z","author_association":"CONTRIBUTOR","body":"- Laravel Version: 5.1.46\r\n- PHP Version: 7.2.3\r\n\r\n### Description:\r\nThe current release of Laravel 5.1 (5.1.46) depends on paragonie/random_compat:~1.4.  This produces the following security notice from sensiolabs/security-checker:\r\n```\r\nparagonie/random_compat (v1.4.2)\r\n--------------------------------\r\n * Uses insecure CSPRNG (openssl_random_pseudo_bytes())\r\n   https://github.com/paragonie/random_compat/issues/96\r\n```\r\nThis was already fixed way back in April in 93074f4 where paragonie/random_compat:~2.0 is allowed, it just needs to be released.  Since this is a security issue, and such a minor one at that, I hope it can get rolled out before it goes EOL in June."},"comment":{"url":"https://api.github.com/repos/laravel/framework/issues/comments/387208720","html_url":"https://github.com/laravel/framework/issues/23611#issuecomment-387208720","issue_url":"https://api.github.com/repos/laravel/framework/issues/23611","id":387208720,"user":{"login":"hackel","id":583677,"avatar_url":"https://avatars2.githubusercontent.com/u/583677?v=4","gravatar_id":"","url":"https://api.github.com/users/hackel","html_url":"https://github.com/hackel","followers_url":"https://api.github.com/users/hackel/followers","following_url":"https://api.github.com/users/hackel/following{/other_user}","gists_url":"https://api.github.com/users/hackel/gists{/gist_id}","starred_url":"https://api.github.com/users/hackel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hackel/subscriptions","organizations_url":"https://api.github.com/users/hackel/orgs","repos_url":"https://api.github.com/users/hackel/repos","events_url":"https://api.github.com/users/hackel/events{/privacy}","received_events_url":"https://api.github.com/users/hackel/received_events","type":"User","site_admin":false},"created_at":"2018-05-07T21:14:30Z","updated_at":"2018-05-07T21:14:30Z","author_association":"CONTRIBUTOR","body":"@browner12 Yes, that is exactly what I said, however the PR *still* has not been released.  I had to resort to pulling a raw commit to fix this, which is pretty bad.  That's why I was hoping a 5.1.47 release could be made before time is up.\r\n    `  \"laravel/framework\": \"5.1.x-dev#93074f403ea0ad3676aa9422f7e6ce35f3fd2c37\",`\r\n\r\n@tillkruss Any explanation for closing this issue, while a supported LTS release remains with such a security vulnerability?  The issue is clearly not fixed.  Is there a release plan?"}}
{"actor":{"display_login":"hackel"}}