Vulnerability Description
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 8.0.0, < 8.0.28 |
Related Weaknesses (CWE)
References
- https://bugs.php.net/bug.php?id=81744Vendor Advisory
- https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4ExploitVendor Advisory
- https://bugs.php.net/bug.php?id=81744Vendor Advisory
- https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4ExploitVendor Advisory
- https://security.netapp.com/advisory/ntap-20230331-0008/
FAQ
What is CVE-2023-0567?
CVE-2023-0567 is a vulnerability with a CVSS score of 7.7 (HIGH). In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password d...
How severe is CVE-2023-0567?
CVE-2023-0567 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-0567?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php.