CVE-2024-3096

2024-04-1600:00:00

ubuntu.com

cve-2024-3096

password_verify

returns true

ato risk

pear

php-pear

xenial

unix

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.6%

JSON

In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before
8.3.5, if a password stored with password_hash() starts with a null byte
(\x00), testing a blank string as the password via password_verify() will
incorrectly return true.

Notes

Author	Note
leosilva	version in noble is not affected see (LP: #2061147)

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchphp5< anyUNKNOWN
ubuntu16.04noarchphp7.0< 7.0.33-0ubuntu0.16.04.16+esm9) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN
ubuntu18.04noarchphp7.2< 7.2.24-0ubuntu0.18.04.17+esm3) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN
ubuntu20.04noarchphp7.4< 7.4.3-4ubuntu2.22UNKNOWN
ubuntu22.04noarchphp8.1< 8.1.2-1ubuntu2.17UNKNOWN
ubuntu23.10noarchphp8.2< 8.2.10-2ubuntu2.1UNKNOWN
ubuntu24.04noarchphp8.3< 8.3.6-0maysync1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	php5	< any	UNKNOWN
ubuntu	16.04	noarch	php7.0	< 7.0.33-0ubuntu0.16.04.16+esm9) Available with Ubuntu Pro or Ubuntu Pro (Infra-only	UNKNOWN
ubuntu	18.04	noarch	php7.2	< 7.2.24-0ubuntu0.18.04.17+esm3) Available with Ubuntu Pro or Ubuntu Pro (Infra-only	UNKNOWN
ubuntu	20.04	noarch	php7.4	< 7.4.3-4ubuntu2.22	UNKNOWN
ubuntu	22.04	noarch	php8.1	< 8.1.2-1ubuntu2.17	UNKNOWN
ubuntu	23.10	noarch	php8.2	< 8.2.10-2ubuntu2.1	UNKNOWN
ubuntu	24.04	noarch	php8.3	< 8.3.6-0maysync1	UNKNOWN