CVE-2023-0567
password_verify() always returns true for some invalid hashes
6.2
MEDIUM
CVSS 3.1
EPSS 0.18%
Description
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.
How to fix CVE-2023-0567
To remediate CVE-2023-0567, upgrade the affected package to a fixed version below.
- —upgrade to 8.0.28 or later
- —upgrade to 8.0.28 or later
- —upgrade to 8.0.28 or later
- —upgrade to 7.4.33-1+deb11u3 or later
- —upgrade to 8.2.4-1 or later
Is CVE-2023-0567 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (5)
- >= 8.0.0, < 8.0.28, >= 8.1.0, < 8.1.16, >= 8.2.0, < 8.2.3
- >= 8.0.0, < 8.0.28, >= 8.1.0, < 8.1.16, >= 8.2.0, < 8.2.3
- >= 8.0.0, < 8.0.28, >= 8.1.0, < 8.1.16, >= 8.2.0, < 8.2.3
- from 0, < 7.4.33-1+deb11u3
- from 0, < 8.2.4-1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |