CVE-2023-0567 password_verify() always returns true for some invalid hashes
Attackers can bypass authentication if invalid Blowfish hashes are stored, as password_verify incorrectly accepts them as valid.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-0567?
CVE-2023-0567 is a high-severity authentication bypass vulnerability in Php Php, published on 16 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.
Weakness: CWE-916
Which versions are affected by CVE-2023-0567?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 8.0.0 | 8.0.28, 8.1.16, 8.2.3 |
php Bitnami | From 8.0.0 | 8.0.28, 8.1.16, 8.2.3 |
php-min Bitnami | From 8.0.0 | 8.0.28, 8.1.16, 8.2.3 |
Products include Php Php.
How do I fix CVE-2023-0567?
Upgrade libphp to a fixed version for your release line: 8.0.28, 8.1.16 or 8.2.3.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-0567 being exploited?
There is no known exploitation of CVE-2023-0567 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as AZL-13740, BIT-libphp-2023-0567, BIT-php-2023-0567, BIT-php-min-2023-0567, DEBIAN-CVE-2023-0567, ECHO-9fe9-6b49-081e and 3 more.