Lucene search

GoogleOSV:BIT-PHP-2024-3096

HistoryMay 14, 2024 - 7:29 a.m.

BIT-php-2024-3096

2024-05-1407:29:06

Google

osv.dev

php

version

vulnerability

password_hash

password_verify

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.1%

JSON

In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

CPENameOperatorVersion
phpge8.1.0
phpge8.2.0
phpge8.3.0
phplt8.2.18
phplt8.1.28
phplt8.3.5

Name	Operator	Version
php	ge	8.1.0
php	ge	8.2.0
php	ge	8.3.0
php	lt	8.2.18
php	lt	8.1.28
php	lt	8.3.5

References

www.openwall.com/lists/oss-security/2024/04/12/11

github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr

lists.debian.org/debian-lts-announce/2024/05/msg00005.html