Vulnerability · Published Feb 16, 2023 · Assigned by php

CVE-2023-0567password_verify() always returns true for some invalid hashes

High 7.7

In plain English

A high-severity security flaw in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.9%top 39.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8apcu-panel5.1.20-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:9apcu-panel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8libzip1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8libzip1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-devel1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8libzip-devel1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8libzip-tools1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-tools1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-bcmath7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-bcmath8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-bcmath8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-bcmath8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-cli8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-cli7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-cli8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-cli8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-common8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-common7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-common8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-common8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-dba8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-dba7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-dba8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-dba8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-dbg8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-dbg7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-dbg8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-dbg8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-devel7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-devel8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-devel8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-devel8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-embedded7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-embedded8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-embedded8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-embedded8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-enchant7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-enchant8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-enchant8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-enchant8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-ffi7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ffi8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-ffi8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-ffi8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-fpm8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-fpm7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-fpm8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-fpm8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-gd8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-gd7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-gd8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-gd8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-gmp7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-gmp8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-gmp8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-gmp8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-intl7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-intl8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-intl8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-intl8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-json7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ldap7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ldap8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-ldap8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-ldap8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-mbstring7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-mbstring8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-mbstring8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-mbstring8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-mysqlnd7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-mysqlnd8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-mysqlnd8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-mysqlnd8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-odbc8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-odbc7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-odbc8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-odbc8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-opcache7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-opcache8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-opcache8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-opcache8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-pdo8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-pdo7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pdo8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-pdo8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-pear1:1.10.13-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-apcu5.1.20-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8php-pecl-apcu5.1.20-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pecl-apcu5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-apcu-devel5.1.20-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8php-pecl-apcu-devel5.1.20-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pecl-apcu-devel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.4.0+2229+b272fdefALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.3.0+2009+b272fdefALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3059+d65eee13ALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-xdebug33.1.2-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-xdebug33.1.2-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:9php-pecl-xdebug33.1.4-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8php-pecl-zip1.19.2-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-zip1.19.2-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pecl-zip1.20.1-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pgsql8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-pgsql7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pgsql8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-pgsql8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-process8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-process7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-process8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-process8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-snmp8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-snmp7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-snmp8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-snmp8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-soap8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-soap7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-soap8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-soap8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-xml7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-xml8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-xml8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-xml8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-xmlrpc7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
Alpine:v3.20php828.2.3-r0ALPINE-CVE-2023-0567
Alpine:v3.21php828.2.3-r0ALPINE-CVE-2023-0567
Alpine:v3.22php828.2.3-r0ALPINE-CVE-2023-0567
Debian:12php8.28.2.4-1DEBIAN-CVE-2023-0567
Rocky Linux:8libzip0:1.6.1-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8libzip0:1.7.3-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:8php0:8.0.30-1.module+el8.8.0+1550+d8f1b18fRLSA-2023:5927
Rocky Linux:8php0:7.4.33-2.module+el8.10.0+1912+72767185RLSA-2024:10952
Rocky Linux:9php0:8.0.30-1.el9_2RLSA-2023:5926
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pear1:1.10.13-1.module+el8.7.0+1067+0a7071ccRLSA-2023:5927
Rocky Linux:8php-pecl-apcu0:5.1.20-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:9php-pecl-apcu0:5.1.21-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Rocky Linux:8php-pecl-rrd0:2.0.3-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32041+66e66fb7RLSA-2024:0387
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32042+808943aeRLSA-2024:0387
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-xdebug30:3.1.2-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:9php-pecl-xdebug30:3.1.4-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-zip0:1.19.2-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:9php-pecl-zip0:1.20.1-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.11USN-5902-1
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.11UBUNTU-CVE-2023-0567

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.0.* – before 8.0.288.1.* – before 8.1.168.2.* – before 8.2.3

Weakness: CWE-916 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References