Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2024-3096

PHP function password_verify can erroneously return true when argument contains NUL

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

Default version status: affected

  • 8.1.* to < 8.1.28affected
  • 8.2.* to < 8.2.18affected
  • 8.3.* to < 8.3.5affected

References