CVE-2024-3096

2024-04-2904:15:08

Debian Security Bug Tracker

security-tracker.debian.org

php

password_hash

null byte

security

vulnerability

unix

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.8%

JSON

In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

OSVersionArchitecturePackageVersionFilename
Debian10allphp7.3< 7.3.31-1~deb10u6php7.3_7.3.31-1~deb10u6_all.deb
Debian11allphp7.4< 7.4.33-1+deb11u5php7.4_7.4.33-1+deb11u5_all.deb
Debian12allphp8.2< 8.2.18-1~deb12u1php8.2_8.2.18-1~deb12u1_all.deb
Debian999allphp8.2< 8.2.18-1php8.2_8.2.18-1_all.deb
Debian13allphp8.2< 8.2.18-1php8.2_8.2.18-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	php7.3	< 7.3.31-1~deb10u6	php7.3_7.3.31-1~deb10u6_all.deb
Debian	11	all	php7.4	< 7.4.33-1+deb11u5	php7.4_7.4.33-1+deb11u5_all.deb
Debian	12	all	php8.2	< 8.2.18-1~deb12u1	php8.2_8.2.18-1~deb12u1_all.deb
Debian	999	all	php8.2	< 8.2.18-1	php8.2_8.2.18-1_all.deb
Debian	13	all	php8.2	< 8.2.18-1	php8.2_8.2.18-1_all.deb