CVE-2023-0567: password_verify() always returns true for some invalid hashes
CVE-2023-0567[0]: PHP: Passwordverify() always return true with some hash
[0] https://security-tracker.debian.org/tracker/CVE-2023-0567 https://www.cve.org/CVERecord?id=CVE-2023-0567 https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4
Other sources
Fixed bug (Passwordverify() always return true with some hash). (CVE-2023-0567)
— PHP
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.
— Launchpad
passwordverify() always returns true for some invalid hashes
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.16-1 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.32-1~deb12u1Fixed in 8.2.35-1~deb12u1 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.4.33-r1 - Upgrade
Upgrade
alpine/php8to a version that resolves this vulnerability.Fixed in 8.0.28-r0 - Upgrade
Upgrade
alpine/php81to a version that resolves this vulnerability.Fixed in 8.1.17-r0 - Upgrade
Upgrade
alpine/php81to a version that resolves this vulnerability.Fixed in 8.1.16-r0 - Upgrade
Upgrade
alpine/php82to a version that resolves this vulnerability.Fixed in 8.2.3-r0 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.0.28 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.16 - Compensating control
If an invalid Blowfish hash could be present in the password database, review/validate password hash entries to ensure they are valid, since password_verify() may accept invalid hashes as valid.
Event History
Frequently Asked Questions
What is the vulnerability ID for this bug?
The vulnerability ID for this bug is CVE-2023-0567.
What is the title of this bug?
The title of this bug is Fixed bug (Password_verify() always return true with some hash).
What is the affected software?
The affected software is PHP 8.2.3.
How severe is this vulnerability?
The severity of this vulnerability is not mentioned.
How can I fix this vulnerability?
The vulnerability can be fixed by updating PHP to version 8.2.3.