CVE-2024-3096: PHP function password_verify can erroneously return true when argument contains NUL
Fixed bug GHSA-h746-cjrr-wfmr (passwordverify can erroneously return true, opening ATO risk). (CVE-2024-3096)
Other sources
If a password stored with passwordhash starts with a null byte (\x00), testing a blank string as the password via passwordverify will incorrectly return true.
If a user were able to create a password with a leading null byte (unlikely, but syntactically valid), an attacker could trivially compromise the victim's account by attempting to sign in with a blank string.
— Red Hat
In PHP version 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, if a password stored with passwordhash() starts with a null byte (\x00), testing a blank string as the password via passwordverify() will incorrectly return true.
— NVD
PHP function passwordverify can erroneously return true when argument contains NUL
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u5 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.20-1~deb12u1Fixed in 8.2.23-1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.28 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.1.28 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.2.18 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.3.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.28-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.4-1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.18 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.5 - Compensating control
If possible, use a compensating authentication control to prevent blank passwords from being accepted (e.g., block sign-in attempts where the submitted password is an empty string) until all systems are upgraded to the fixed PHP versions.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3096?
CVE-2024-3096 has a moderate severity level due to the potential for unauthorized access if exploited.
How do I fix CVE-2024-3096?
To fix CVE-2024-3096, update to the recommended versions of PHP: 7.4.33-1+deb11u5, 8.2.20-1~deb12u1, 8.2.23, or 8.1.28.
What does CVE-2024-3096 affect?
CVE-2024-3096 affects the PHP password_verify function, particularly when handling passwords with null bytes.
What issues can arise from CVE-2024-3096?
CVE-2024-3096 can lead to an authorization token (ATO) risk if blank strings are incorrectly accepted as valid passwords.
Which PHP versions are vulnerable to CVE-2024-3096?
The vulnerable PHP versions include 7.4, 8.1.x, and 8.2.x prior to their respective patched versions.