CVE-2023-0567

HIGH 7.7

password_verify() always returns true for some invalid hashes

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

Vendor	php group
Product	php
Published	Feb 16, 2023
Last Updated	Aug 2, 2024

Stay Ahead of the Next One

Get instant alerts for php group php

Be the first to know when new high vulnerabilities affecting php group php are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

PHP Group / PHP

8.0.x < 8.0.28 8.1.x < 8.1.16 8.2.x < 8.2.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

bugs.php.net: https://bugs.php.net/bug.php?id=81744 github.com: https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4 security.netapp.com: https://security.netapp.com/advisory/ntap-20230331-0008/

Credits

Tim Düsterhus tech at mkdgs dot fr