DEBIAN-CVE-2023-0567

DEBIAN-CVE-2023-0567 PUBLISHED CVSS 6.199999809265137 MEDIUM

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

Risk Scores

CVSS 3.1

6.199999809265137

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products

Vendor	Product	Versions
Debian:12	php8.2	0, 0, 0
Debian:11	php7.4	0, 7.4.21-1, 7.4.25-1

Exploit Intelligence

cve_db.json (github-poc)

Timeline

Mar 1, 2023 CVE Published
Apr 28, 2026 CVE Updated

References

https://security-tracker.debian.org/tracker/CVE-2023-0567 advisory

Open in Interactive Console →