CVE-2023-0567

Description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

CVSS Metrics

• v3.1•HIGH•Score: 7.7CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• v3.1•MEDIUM•Score: 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.14%• Percentile: 34%

Techniques & Countermeasures

• CWE-916•Use of Password Hash With Insufficient Computational Effort

  The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Affected Systems

• Unknown•PHP

  ≥ 8.0.x, < 8.0.28 | ≥ 8.1.x, < 8.1.16 | ≥ 8.2.x, < 8.2.3

• Unknown•PHP

  ≥ 8.0.0, < 8.0.28 | ≥ 8.1.0, < 8.1.16 | ≥ 8.2.0, < 8.2.3

References (3)

• https://bugs.php.net/bug.php?id=81744
• https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4
• https://security.netapp.com/advisory/ntap-20230331-0008/